feat: add authentication, user management, and admin features
Added comprehensive authentication and authorization system: Authentication System: - Better Auth integration with session management - Login/logout pages and API routes - Middleware for route protection - Auth utilities and client libraries User Management: - User list, detail, and invite pages - User API endpoints (CRUD operations) - Session management for users - Profile settings page Role-Based Access Control: - Role management pages (list, create, edit) - Permission system with granular controls - Role assignment to users - Role API endpoints Admin Features: - Audit log page for tracking system events - Admin settings page - Audit service for logging user actions Additional Features: - Quotes management pages and components - SalesBldr API integration - Email service for notifications Configuration & Documentation: - Updated docker-compose.yml - MCP server configuration (mcp.json) - CVE-2025-55182 security review documentation - Standards guide and PRD documents - Re-enabling authentication documentation Database Migrations: - 012: Auth tables (users, sessions, accounts, verifications) - 013: Role tables (roles, permissions, role_permissions, user_roles) - 014: Admin settings table UI Updates: - Updated dashboard layout - Enhanced app layout with auth integration
This commit is contained in:
root
parent
d8e6931b85
commit
9f912aed24
68 changed files with 7651 additions and 3 deletions
76
migrations/012_create_auth_tables.sql
Normal file
76
migrations/012_create_auth_tables.sql
Normal file
|
|
@ -0,0 +1,76 @@
|
|||
-- Better Auth Core Tables Migration
|
||||
-- Creates user, session, account, and verification tables for Better Auth
|
||||
|
||||
-- User table
|
||||
CREATE TABLE IF NOT EXISTS "user" (
|
||||
id TEXT PRIMARY KEY,
|
||||
name TEXT NOT NULL,
|
||||
email TEXT NOT NULL UNIQUE,
|
||||
email_verified BOOLEAN NOT NULL DEFAULT FALSE,
|
||||
image TEXT,
|
||||
role TEXT DEFAULT 'user',
|
||||
banned BOOLEAN DEFAULT FALSE,
|
||||
banned_reason TEXT,
|
||||
ban_expires TIMESTAMP,
|
||||
requires_setup BOOLEAN DEFAULT FALSE,
|
||||
created_at TIMESTAMP NOT NULL DEFAULT NOW(),
|
||||
updated_at TIMESTAMP NOT NULL DEFAULT NOW()
|
||||
);
|
||||
|
||||
-- Session table
|
||||
CREATE TABLE IF NOT EXISTS "session" (
|
||||
id TEXT PRIMARY KEY,
|
||||
user_id TEXT NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
|
||||
token TEXT NOT NULL UNIQUE,
|
||||
expires_at TIMESTAMP NOT NULL,
|
||||
ip_address TEXT,
|
||||
user_agent TEXT,
|
||||
created_at TIMESTAMP NOT NULL DEFAULT NOW(),
|
||||
updated_at TIMESTAMP NOT NULL DEFAULT NOW()
|
||||
);
|
||||
|
||||
-- Account table (for OAuth providers)
|
||||
CREATE TABLE IF NOT EXISTS "account" (
|
||||
id TEXT PRIMARY KEY,
|
||||
user_id TEXT NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
|
||||
account_id TEXT NOT NULL,
|
||||
provider_id TEXT NOT NULL,
|
||||
access_token TEXT,
|
||||
refresh_token TEXT,
|
||||
access_token_expires_at TIMESTAMP,
|
||||
refresh_token_expires_at TIMESTAMP,
|
||||
scope TEXT,
|
||||
id_token TEXT,
|
||||
password TEXT,
|
||||
created_at TIMESTAMP NOT NULL DEFAULT NOW(),
|
||||
updated_at TIMESTAMP NOT NULL DEFAULT NOW()
|
||||
);
|
||||
|
||||
-- Verification table (for magic links, email verification, etc.)
|
||||
CREATE TABLE IF NOT EXISTS "verification" (
|
||||
id TEXT PRIMARY KEY,
|
||||
identifier TEXT NOT NULL,
|
||||
value TEXT NOT NULL,
|
||||
expires_at TIMESTAMP NOT NULL,
|
||||
created_at TIMESTAMP NOT NULL DEFAULT NOW(),
|
||||
updated_at TIMESTAMP NOT NULL DEFAULT NOW()
|
||||
);
|
||||
|
||||
-- Two-factor authentication table
|
||||
CREATE TABLE IF NOT EXISTS "two_factor" (
|
||||
id TEXT PRIMARY KEY,
|
||||
user_id TEXT NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
|
||||
secret TEXT NOT NULL,
|
||||
backup_codes TEXT NOT NULL,
|
||||
created_at TIMESTAMP NOT NULL DEFAULT NOW(),
|
||||
updated_at TIMESTAMP NOT NULL DEFAULT NOW()
|
||||
);
|
||||
|
||||
-- Indexes for performance
|
||||
CREATE INDEX IF NOT EXISTS idx_session_user_id ON "session"(user_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_session_token ON "session"(token);
|
||||
CREATE INDEX IF NOT EXISTS idx_account_user_id ON "account"(user_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_account_provider ON "account"(provider_id, account_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_verification_identifier ON "verification"(identifier);
|
||||
CREATE INDEX IF NOT EXISTS idx_user_email ON "user"(email);
|
||||
CREATE INDEX IF NOT EXISTS idx_two_factor_user_id ON "two_factor"(user_id);
|
||||
43
migrations/013_create_role_tables.sql
Normal file
43
migrations/013_create_role_tables.sql
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
-- Role and Permission Tables Migration
|
||||
-- Creates tables for custom role management beyond Better Auth's built-in roles
|
||||
|
||||
-- Custom roles table (for user-defined roles beyond the defaults)
|
||||
CREATE TABLE IF NOT EXISTS "role" (
|
||||
id TEXT PRIMARY KEY,
|
||||
name TEXT NOT NULL UNIQUE,
|
||||
description TEXT,
|
||||
permissions JSONB NOT NULL DEFAULT '{}',
|
||||
is_system BOOLEAN NOT NULL DEFAULT FALSE,
|
||||
created_at TIMESTAMP NOT NULL DEFAULT NOW(),
|
||||
updated_at TIMESTAMP NOT NULL DEFAULT NOW()
|
||||
);
|
||||
|
||||
-- User-role assignments (for custom roles)
|
||||
-- Note: Better Auth stores the primary role in the user table
|
||||
-- This table is for additional role assignments if needed
|
||||
CREATE TABLE IF NOT EXISTS "user_role" (
|
||||
id TEXT PRIMARY KEY,
|
||||
user_id TEXT NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
|
||||
role_id TEXT NOT NULL REFERENCES "role"(id) ON DELETE CASCADE,
|
||||
assigned_at TIMESTAMP NOT NULL DEFAULT NOW(),
|
||||
assigned_by TEXT REFERENCES "user"(id) ON DELETE SET NULL,
|
||||
UNIQUE(user_id, role_id)
|
||||
);
|
||||
|
||||
-- Indexes
|
||||
CREATE INDEX IF NOT EXISTS idx_role_name ON "role"(name);
|
||||
CREATE INDEX IF NOT EXISTS idx_user_role_user_id ON "user_role"(user_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_user_role_role_id ON "user_role"(role_id);
|
||||
|
||||
-- Insert default system roles
|
||||
INSERT INTO "role" (id, name, description, permissions, is_system) VALUES
|
||||
('role_super_admin', 'super-admin', 'Full system access with all permissions',
|
||||
'{"tickets": ["create", "read", "update", "delete"], "configItems": ["create", "read", "update", "delete"], "admin": ["access"], "users": ["create", "read", "update", "delete", "invite", "ban"], "roles": ["create", "read", "update", "delete"], "auditLog": ["read"], "settings": ["read", "update"]}',
|
||||
TRUE),
|
||||
('role_admin', 'admin', 'Administrative access without role management',
|
||||
'{"tickets": ["create", "read", "update", "delete"], "configItems": ["create", "read", "update", "delete"], "admin": ["access"], "users": ["create", "read", "update", "invite"], "roles": ["read"], "auditLog": ["read"], "settings": ["read"]}',
|
||||
TRUE),
|
||||
('role_user', 'user', 'Standard user access',
|
||||
'{"tickets": ["create", "read", "update"], "configItems": ["read"]}',
|
||||
TRUE)
|
||||
ON CONFLICT (id) DO NOTHING;
|
||||
78
migrations/014_create_admin_settings.sql
Normal file
78
migrations/014_create_admin_settings.sql
Normal file
|
|
@ -0,0 +1,78 @@
|
|||
-- Admin Settings Tables Migration
|
||||
-- Creates app_settings, session_policy, and email_template tables
|
||||
|
||||
-- App settings table (key-value store for application settings)
|
||||
CREATE TABLE IF NOT EXISTS "app_settings" (
|
||||
id TEXT PRIMARY KEY,
|
||||
key TEXT NOT NULL UNIQUE,
|
||||
value TEXT,
|
||||
description TEXT,
|
||||
created_at TIMESTAMP NOT NULL DEFAULT NOW(),
|
||||
updated_at TIMESTAMP NOT NULL DEFAULT NOW()
|
||||
);
|
||||
|
||||
-- Session policy table (CIDR-based session timeout policies)
|
||||
CREATE TABLE IF NOT EXISTS "session_policy" (
|
||||
id TEXT PRIMARY KEY,
|
||||
name TEXT NOT NULL,
|
||||
cidr TEXT NOT NULL,
|
||||
timeout_seconds INTEGER NOT NULL DEFAULT 86400,
|
||||
priority INTEGER NOT NULL DEFAULT 0,
|
||||
enabled BOOLEAN NOT NULL DEFAULT TRUE,
|
||||
created_at TIMESTAMP NOT NULL DEFAULT NOW(),
|
||||
updated_at TIMESTAMP NOT NULL DEFAULT NOW()
|
||||
);
|
||||
|
||||
-- Email template table
|
||||
CREATE TABLE IF NOT EXISTS "email_template" (
|
||||
id TEXT PRIMARY KEY,
|
||||
type TEXT NOT NULL UNIQUE,
|
||||
subject TEXT NOT NULL,
|
||||
body_html TEXT NOT NULL,
|
||||
body_text TEXT,
|
||||
variables TEXT, -- JSON array of available variables
|
||||
created_at TIMESTAMP NOT NULL DEFAULT NOW(),
|
||||
updated_at TIMESTAMP NOT NULL DEFAULT NOW()
|
||||
);
|
||||
|
||||
-- Audit log table
|
||||
CREATE TABLE IF NOT EXISTS "audit_log" (
|
||||
id TEXT PRIMARY KEY,
|
||||
timestamp TIMESTAMP NOT NULL DEFAULT NOW(),
|
||||
user_id TEXT REFERENCES "user"(id) ON DELETE SET NULL,
|
||||
user_email TEXT,
|
||||
action TEXT NOT NULL,
|
||||
resource TEXT NOT NULL,
|
||||
resource_id TEXT,
|
||||
details JSONB,
|
||||
ip_address TEXT,
|
||||
user_agent TEXT
|
||||
);
|
||||
|
||||
-- Indexes
|
||||
CREATE INDEX IF NOT EXISTS idx_app_settings_key ON "app_settings"(key);
|
||||
CREATE INDEX IF NOT EXISTS idx_session_policy_priority ON "session_policy"(priority DESC);
|
||||
CREATE INDEX IF NOT EXISTS idx_email_template_type ON "email_template"(type);
|
||||
CREATE INDEX IF NOT EXISTS idx_audit_log_timestamp ON "audit_log"(timestamp DESC);
|
||||
CREATE INDEX IF NOT EXISTS idx_audit_log_user_id ON "audit_log"(user_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_audit_log_action ON "audit_log"(action);
|
||||
CREATE INDEX IF NOT EXISTS idx_audit_log_resource ON "audit_log"(resource);
|
||||
|
||||
-- Insert default app settings
|
||||
INSERT INTO "app_settings" (id, key, value, description) VALUES
|
||||
('setting_microsoft_tenant', 'microsoft_tenant_id', 'common', 'Microsoft Entra ID tenant ID'),
|
||||
('setting_session_timeout', 'default_session_timeout', '86400', 'Default session timeout in seconds'),
|
||||
('setting_audit_retention', 'audit_log_retention_days', '90', 'Number of days to retain audit logs')
|
||||
ON CONFLICT (key) DO NOTHING;
|
||||
|
||||
-- Insert default email templates
|
||||
INSERT INTO "email_template" (id, type, subject, body_html, body_text, variables) VALUES
|
||||
('template_magic_link', 'magic_link', 'Sign in to Pulse',
|
||||
'<h1>Sign in to Pulse</h1><p>Click the link below to sign in:</p><a href="{{url}}">Sign in</a><p>This link expires in 5 minutes.</p>',
|
||||
'Sign in to Pulse\n\nClick the link below to sign in:\n{{url}}\n\nThis link expires in 5 minutes.',
|
||||
'["url", "email"]'),
|
||||
('template_invitation', 'invitation', 'You''re invited to Pulse',
|
||||
'<h1>You''re invited!</h1><p>{{inviter_name}} has invited you to join Pulse.</p><a href="{{url}}">Accept Invitation</a>',
|
||||
'You''re invited!\n\n{{inviter_name}} has invited you to join Pulse.\n\nAccept invitation: {{url}}',
|
||||
'["url", "email", "inviter_name"]')
|
||||
ON CONFLICT (type) DO NOTHING;
|
||||
Loading…
Add table
Add a link
Reference in a new issue