bvandeusenandClaude Opus 5.5
c533eec33a
#5336 "Users page: list accounts, change role, disable, reset a local password, create a local user". - Settings › Users (admin only, a Settings tab): every account with how it signs in, its role, last sign-in (from the audit log) and working AI tokens; disabled accounts last. A row opens the account. - An account's page: rename (any account), role and password (local accounts; an LDAP or single sign-on role comes from the provider at every sign-in, and the page says so), disable or enable, and Delete behind the confirm dialog. - Refusals are said beside the control: nobody disables, demotes or deletes themselves, the last active admin stays, and an account that made alert rules, maintenance windows or playbook runs is disabled rather than deleted (those records keep who made them). - Add user: a local account with a role and a password of 8+ characters. - Every change is audited as user.*, and the audit log names and links the account. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
30 lines
1.3 KiB
Python
30 lines
1.3 KiB
Python
"""Settings › Users keeps someone able to get back in (#5336): nobody can
|
||
disable, demote or delete their own account, and the last active admin
|
||
cannot be demoted or disabled."""
|
||
from steward.models.users import User, UserRole
|
||
from steward.settings.users import password_problem, refusal
|
||
|
||
|
||
def _u(uid, role=UserRole.admin, active=True):
|
||
return User(id=uid, username=uid, email=f"{uid}@t", password_hash="x", role=role, is_active=active)
|
||
|
||
|
||
def test_nobody_changes_their_own_access():
|
||
me = _u("me")
|
||
for change in ("demote", "disable", "delete"):
|
||
assert "own" in refusal(change, me, "me", active_admins=5)
|
||
|
||
|
||
def test_the_last_active_admin_stays():
|
||
only = _u("only")
|
||
assert "only active admin" in refusal("demote", only, "someone-else", active_admins=1)
|
||
assert refusal("demote", only, "someone-else", active_admins=2) is None
|
||
assert refusal("disable", _u("v", role=UserRole.viewer), "me", active_admins=1) is None
|
||
assert refusal("delete", _u("gone", active=False), "me", active_admins=1) is None
|
||
|
||
|
||
def test_a_password_is_long_enough_and_typed_twice():
|
||
assert "at least" in password_problem("short", "short")
|
||
assert "match" in password_problem("long enough", "long enougj")
|
||
assert password_problem("long enough", "long enough") is None
|