5 Commits

Include renames

Author	SHA1	Message	Date
Dan MilneandClaude Opus 4.8	782e197d91	Fix access check form: use GET so results render ... The access check form POSTed and re-rendered :new with a 200 HTML response, which Turbo rejects ("Form responses must redirect to another location"), so the result panel never appeared. Since the check is a read-only query, switch to a GET form and fold the lookup into the new action. Results are now bookmarkable via the URL. Bump version to 0.16.2. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-21 15:42:57 +10:00
Dan MilneandClaude Opus 4.8	aa5736ddab	Update gems and fix lint to clear CI failures ... Bumps dependencies (jwt 3.2.0, puma 8.0.2, net-imap 0.6.4.1 and others via bundle update) to resolve bundler-audit advisories, and applies standardrb autofixes so the lint job passes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-21 13:51:23 +10:00
Dan MilneandClaude Opus 4.7	2843790cef	Apps index access column + summary + admin access checker ... The Applications index used to render "All users" whenever an app had no allowed_groups; under default-deny that's the opposite of the truth. Replaced with a "No one" badge and, when groups are present, a "N users · M groups" cell so the access reality is visible at a glance. Added a small stats strip above the apps table: applications, users with access, and groups granting access. Backed by preloaded counts in the controller to avoid N+1. Added /admin/access — a small "Access check" tool that takes a user and an application and reports whether the user can reach it, with the granting group(s) when allowed, and the specific reason when not (inactive app/user, no allowed groups, or no shared group). Wired into the admin sidebar. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-06-07 18:38:56 +10:00
Dan MilneandClaude Opus 4.7	03dfdbd83a	Default-deny access control with group flags and access enumeration ... Replaces the implicit "empty allowed_groups means public" rule with explicit default-deny across both OIDC and ForwardAuth. Adds two boolean flags on Group — auto_assign (Keycloak-style auto-join on user create) and admin (members can reach the admin panel) — and drops the users.admin column entirely. Adds "Users with access" and "Accessible applications" panels with via-group badges on the application/user show pages. BEHAVIOR CHANGE: a ForwardAuth app with no allowed_groups previously bypassed authentication entirely; it now returns 403 like any other unauthorized request. The data migration seeds an "everyone" group and attaches it to all previously group-less apps to preserve behavior on existing installs. An "admins" group is seeded and backfilled from any user with the old admin column. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-06-07 15:53:27 +10:00
Dan MilneandClaude Opus 4.7	a399907dfd	Allow assigning applications to a group from the group form ... Adds an "Assigned Applications" checkbox list to the group new/edit form so admins can grant a group access to multiple apps from one screen, instead of editing each application individually. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-28 21:17:43 +10:00