Admin API (v0.3) #10

Merged

Cordy merged 6 commits from feat/admin-api into main

2026-07-21 19:26:21 +00:00

Cordy commented

2026-07-21 19:25:20 +00:00

Owner

Minimal operator surface for v0.3. Admin identity is a username allow-list (auth.admins in config), so it works identically across local / OIDC / LDAP — usernames match the authenticated User.Username.

Endpoints (registered only when auth.admins is non-empty; each gated to admins, else 403):

GET /api/v1/admin/info — server summary: version, storage driver, auth mode, shares/app-passwords enabled, quota (if Usager), share count.
GET /api/v1/admin/shares — list all share links (any creator). Reuses share.Store.List(ctx, "").
DELETE /api/v1/admin/shares/{token} — revoke any share link (closes the "admin action" gap flagged in shares.go's creator-only revoke).

Also adds a small exported auth.ContextWithUser (for tests + callers that establish identity outside the middleware).

Deliberately excludes fine-grained per-file ACLs (ARCHITECTURE.md §5.4 keeps those out of the MVP). Additive and backward-compatible: with no auth.admins configured, nothing changes.

Tests: admin gate (unauthenticated 403 / non-admin 403 / admin 200 + info body), list-all-shares across creators, revoke-any-share.

Minimal operator surface for v0.3. Admin identity is a **username allow-list** (`auth.admins` in config), so it works identically across local / OIDC / LDAP — usernames match the authenticated `User.Username`. Endpoints (registered only when `auth.admins` is non-empty; each gated to admins, else 403): - `GET /api/v1/admin/info` — server summary: version, storage driver, auth mode, shares/app-passwords enabled, quota (if `Usager`), share count. - `GET /api/v1/admin/shares` — list **all** share links (any creator). Reuses `share.Store.List(ctx, "")`. - `DELETE /api/v1/admin/shares/{token}` — revoke **any** share link (closes the "admin action" gap flagged in `shares.go`'s creator-only revoke). Also adds a small exported `auth.ContextWithUser` (for tests + callers that establish identity outside the middleware). Deliberately excludes fine-grained per-file ACLs (ARCHITECTURE.md §5.4 keeps those out of the MVP). Additive and backward-compatible: with no `auth.admins` configured, nothing changes. Tests: admin gate (unauthenticated 403 / non-admin 403 / admin 200 + info body), list-all-shares across creators, revoke-any-share.

Cordy added 6 commits

2026-07-21 19:25:21 +00:00