Admin RBAC without searchAccount #17

+2 -1

.gitignore

··· 1 1 /target 2 2 .idea 3 3 - pds.env 3 3 + pds.env 4 4 + dev_admin_rbac.yaml

+201

ADMIN.md

··· 1 1 + # PDS Admin Portal 2 2 + 3 3 + ## Overview 4 4 + 5 5 + Bluesky's PDS admin API relies on `PDS_ADMIN_PASSWORD` — a single shared secret that grants unrestricted access to every administrative endpoint. This is workable for solo operators but becomes a liability when multiple team members need admin access. There is no way to limit what any individual can do, no audit trail of who performed an action, and credential rotation affects everyone simultaneously. 6 6 + 7 7 + The pds-gatekeeper admin portal solves this by introducing role-based access control (RBAC). Team members authenticate with ATProto OAuth using their own identity, and gatekeeper enforces per-user permissions based on a YAML configuration file. Authorized requests are proxied to the PDS using the admin password on behalf of the authenticated user — the password itself is never exposed to browsers or end users. 8 8 + 9 9 + ## Prerequisites 10 10 + 11 11 + - A PDS instance running behind pds-gatekeeper 12 12 + - HTTPS with a valid TLS certificate (required for ATProto OAuth flows) 13 13 + - SMTP configured on the PDS for email functionality (used by the PDS itself, not strictly by the admin portal) 14 14 + 15 15 + ## Quick Start 16 16 + 17 17 + ### 1. Create an RBAC configuration file 18 18 + 19 19 + Copy the example configuration as a starting point: 20 20 + 21 21 + ```sh 22 22 + cp examples/admin_rbac.yaml /path/to/your/admin_rbac.yaml 23 23 + ``` 24 24 + 25 25 + ### 2. Find your team members' DIDs 26 26 + 27 27 + Use [`goat`](https://github.com/bluesky-social/indigo/tree/main/cmd/goat) to resolve a handle to its DID: 28 28 + 29 29 + ```sh 30 30 + goat resolve alice.example.com 31 31 + ``` 32 32 + 33 33 + The DID is the `id` field in the output (e.g. `did:plc:abcdef1234567890`). 34 34 + 35 35 + ### 3. Set environment variables 36 36 + 37 37 + ```sh 38 38 + # Required 39 39 + GATEKEEPER_ADMIN_RBAC_CONFIG=/path/to/your/admin_rbac.yaml 40 40 + PDS_ADMIN_PASSWORD=your-pds-admin-password 41 41 + 42 42 + # Optional 43 43 + GATEKEEPER_ADMIN_COOKIE_SECRET=<64-character-hex-string> 44 44 + GATEKEEPER_ADMIN_SESSION_TTL_HOURS=24 45 45 + ``` 46 46 + 47 47 + ### 4. Restart pds-gatekeeper 48 48 + 49 49 + ```sh 50 50 + # If running with systemd: 51 51 + sudo systemctl restart pds-gatekeeper 52 52 + 53 53 + # If running with Docker: 54 54 + docker restart pds-gatekeeper 55 55 + ``` 56 56 + 57 57 + ### 5. Navigate to the admin portal 58 58 + 59 59 + Open your browser and go to: 60 60 + 61 61 + ``` 62 62 + https://your-pds.example.com/admin/login 63 63 + ``` 64 64 + 65 65 + ## RBAC Configuration 66 66 + 67 67 + The RBAC configuration is a YAML file with two top-level sections: `roles` and `members`. 68 68 + 69 69 + - **Roles** define named sets of endpoint patterns that grant access to specific admin operations. 70 70 + - **Members** map an ATProto DID to one or more roles. 71 71 + 72 72 + A member's effective permissions are the **union** of all endpoints from all of their assigned roles. 73 73 + 74 74 + Endpoint patterns support wildcard matching: `com.atproto.admin.*` matches all endpoints under the `com.atproto.admin` namespace. 75 75 + 76 76 + Example: 77 77 + 78 78 + ```yaml 79 79 + roles: 80 80 + pds-admin: 81 81 + endpoints: 82 82 + - "com.atproto.admin.*" 83 83 + - "com.atproto.server.createInviteCode" 84 84 + - "com.atproto.server.createAccount" 85 85 + 86 86 + moderator: 87 87 + endpoints: 88 88 + - "com.atproto.admin.getAccountInfo" 89 89 + - "com.atproto.admin.getAccountInfos" 90 90 + - "com.atproto.admin.getSubjectStatus" 91 91 + - "com.atproto.admin.updateSubjectStatus" 92 92 + - "com.atproto.admin.sendEmail" 93 93 + - "com.atproto.admin.getInviteCodes" 94 94 + 95 95 + invite-manager: 96 96 + endpoints: 97 97 + - "com.atproto.server.createInviteCode" 98 98 + - "com.atproto.admin.getInviteCodes" 99 99 + - "com.atproto.admin.disableInviteCodes" 100 100 + - "com.atproto.admin.enableAccountInvites" 101 101 + - "com.atproto.admin.disableAccountInvites" 102 102 + 103 103 + members: 104 104 + - did: "did:plc:abcdef1234567890" 105 105 + roles: 106 106 + - pds-admin 107 107 + 108 108 + - did: "did:plc:bbbbbbbbbbbbbbbb" 109 109 + roles: 110 110 + - moderator 111 111 + - invite-manager 112 112 + ``` 113 113 + 114 114 + ## Available Roles (Reference) 115 115 + 116 116 + ### Suggested role templates 117 117 + 118 118 + You can make your own roles and teams 119 119 + 120 120 + | Role | Description | Endpoints | 121 121 + |---|---|---| 122 122 + | `pds-admin` | Full administrative access | `com.atproto.admin.*`, `createInviteCode`, `createAccount` | 123 123 + | `moderator` | View accounts, manage takedowns, send email, view invite codes | `getAccountInfo`, `getAccountInfos`, `getSubjectStatus`, `updateSubjectStatus`, `sendEmail`, `getInviteCodes` | 124 124 + | `invite-manager` | Manage invite codes and per-account invite permissions | `createInviteCode`, `getInviteCodes`, `disableInviteCodes`, `enableAccountInvites`, `disableAccountInvites` | 125 125 + 126 126 + ### All admin XRPC endpoints 127 127 + 128 128 + | Endpoint | Description | 129 129 + |---|---| 130 130 + | `com.atproto.admin.getAccountInfo` | View single account details | 131 131 + | `com.atproto.admin.getAccountInfos` | View multiple accounts | 132 132 + | `com.atproto.admin.getSubjectStatus` | Get takedown status | 133 133 + | `com.atproto.admin.updateSubjectStatus` | Apply or remove takedowns | 134 134 + | `com.atproto.admin.deleteAccount` | Permanently delete an account | 135 135 + | `com.atproto.admin.updateAccountPassword` | Reset account password | 136 136 + | `com.atproto.admin.enableAccountInvites` | Enable invites for an account | 137 137 + | `com.atproto.admin.disableAccountInvites` | Disable invites for an account | 138 138 + | `com.atproto.admin.getInviteCodes` | List invite codes | 139 139 + | `com.atproto.admin.disableInviteCodes` | Disable specific invite codes | 140 140 + | `com.atproto.admin.sendEmail` | Send email to an account | 141 141 + | `com.atproto.server.createInviteCode` | Create a new invite code | 142 142 + | `com.atproto.server.createAccount` | Create a new account | 143 143 + 144 144 + ## How It Works 145 145 + 146 146 + ### 1. OAuth Login 147 147 + 148 148 + The user navigates to `/admin/login` and enters their ATProto handle. Gatekeeper initiates an OAuth authorization flow, redirecting the user to their identity's authorization server. The user authenticates there and is redirected back to gatekeeper with an authorization code. 149 149 + 150 150 + ### 2. Session Creation 151 151 + 152 152 + Gatekeeper exchanges the authorization code for tokens, extracts the user's DID from the OAuth session, and checks it against the RBAC configuration. If the DID is found in the members list, a signed session cookie is created and set in the browser. 153 153 + 154 154 + ### 3. Request Flow 155 155 + 156 156 + When the user performs an admin action, gatekeeper: 157 157 + 158 158 + 1. Validates the session cookie signature and expiration 159 159 + 2. Looks up the user's DID in the RBAC configuration 160 160 + 3. Checks whether the user's roles grant access to the target XRPC endpoint 161 161 + 4. If authorized, proxies the request to the PDS with `Authorization: Basic` using `PDS_ADMIN_PASSWORD` 162 162 + 5. Returns the PDS response to the user 163 163 + 164 164 + ### 4. UI Rendering 165 165 + 166 166 + The admin portal uses server-rendered pages that show or hide actions based on the authenticated user's permissions. However, RBAC is always enforced server-side in route handlers regardless of what the UI displays — hiding a button in the template is a convenience, not a security boundary. 167 167 + 168 168 + ## Environment Variables 169 169 + 170 170 + | Variable | Required | Default | Description | 171 171 + |---|---|---|---| 172 172 + | `GATEKEEPER_ADMIN_RBAC_CONFIG` | Yes | — | Path to the RBAC YAML configuration file | 173 173 + | `PDS_ADMIN_PASSWORD` | Yes | — | PDS admin password used for proxied requests | 174 174 + | `GATEKEEPER_ADMIN_COOKIE_SECRET` | No | Derived from `GATEKEEPER_JWE_KEY` | 32-byte hex key for signing session cookies | 175 175 + | `GATEKEEPER_ADMIN_SESSION_TTL_HOURS` | No | `24` | Admin session lifetime in hours | 176 176 + 177 177 + ## Security Considerations 178 178 + 179 179 + - **Password isolation**: `PDS_ADMIN_PASSWORD` is never sent to or accessible from browsers. It is only used server-side when proxying authorized requests to the PDS. 180 180 + - **OAuth security**: The OAuth flow uses DPoP binding and PKCE to prevent token interception and replay attacks. 181 181 + - **Cookie protections**: Session cookies are signed (tamper-proof) and set with `HttpOnly`, `Secure`, and `SameSite=Lax` attributes. 182 182 + - **Server-side enforcement**: RBAC is enforced in route handlers, not just in template rendering. Manipulating the UI cannot bypass access controls. 183 183 + - **Session lifecycle**: Sessions expire after a configurable TTL. Expired sessions are cleaned up automatically. 184 184 + - **Opt-in activation**: The admin portal is completely opt-in. If `GATEKEEPER_ADMIN_RBAC_CONFIG` is not set, no admin routes are mounted and the portal is entirely inactive. 185 185 + 186 186 + ## Troubleshooting 187 187 + 188 188 + **OAuth callback failures** 189 189 + Ensure HTTPS is properly configured with a valid certificate, DNS resolves correctly for your PDS hostname, and the hostname the user accesses matches the PDS configuration. 190 190 + 191 191 + **"Access Denied" after login** 192 192 + Verify that the DID in your RBAC configuration exactly matches the DID of the authenticating identity. Use `goat resolve {handle}` to confirm the correct DID. 193 193 + 194 194 + **Session expired** 195 195 + Sessions expire after the configured TTL (default 24 hours). Either increase `GATEKEEPER_ADMIN_SESSION_TTL_HOURS` or log in again. 196 196 + 197 197 + **403 on admin action** 198 198 + The authenticated user's roles do not include the endpoint being accessed. Check the `members` and `roles` sections of your RBAC config to ensure the required endpoint pattern is granted. 199 199 + 200 200 + **Admin portal not appearing** 201 201 + Confirm that `GATEKEEPER_ADMIN_RBAC_CONFIG` is set in the environment, the file path is correct, and the file exists and is readable by the gatekeeper process.

+1142 -25

Cargo.lock

··· 28 28 checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa" 29 29 30 30 [[package]] 31 31 + name = "adler32" 32 32 + version = "1.2.0" 33 33 + source = "registry+https://github.com/rust-lang/crates.io-index" 34 34 + checksum = "aae1277d39aeec15cb388266ecc24b11c80469deae6067e17a1a7aa9e5c1f234" 35 35 + 36 36 + [[package]] 31 37 name = "ahash" 32 38 version = "0.8.12" 33 39 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 55 61 checksum = "250f629c0161ad8107cf89319e990051fae62832fd343083bea452d93e2205fd" 56 62 57 63 [[package]] 64 64 + name = "alloc-no-stdlib" 65 65 + version = "2.0.4" 66 66 + source = "registry+https://github.com/rust-lang/crates.io-index" 67 67 + checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3" 68 68 + 69 69 + [[package]] 70 70 + name = "alloc-stdlib" 71 71 + version = "0.2.2" 72 72 + source = "registry+https://github.com/rust-lang/crates.io-index" 73 73 + checksum = "94fb8275041c72129eb51b7d0322c29b8387a0386127718b096429201a5d6ece" 74 74 + dependencies = [ 75 75 + "alloc-no-stdlib", 76 76 + ] 77 77 + 78 78 + [[package]] 58 79 name = "allocator-api2" 59 80 version = "0.2.21" 60 81 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 83 104 dependencies = [ 84 105 "object", 85 106 ] 107 107 + 108 108 + [[package]] 109 109 + name = "ascii" 110 110 + version = "1.1.0" 111 111 + source = "registry+https://github.com/rust-lang/crates.io-index" 112 112 + checksum = "d92bec98840b8f03a5ff5413de5293bfcd8bf96467cf5452609f939ec6f5de16" 86 113 87 114 [[package]] 88 115 name = "async-channel" ··· 365 392 ] 366 393 367 394 [[package]] 395 395 + name = "axum-extra" 396 396 + version = "0.10.3" 397 397 + source = "registry+https://github.com/rust-lang/crates.io-index" 398 398 + checksum = "9963ff19f40c6102c76756ef0a46004c0d58957d87259fc9208ff8441c12ab96" 399 399 + dependencies = [ 400 400 + "axum", 401 401 + "axum-core", 402 402 + "bytes", 403 403 + "cookie", 404 404 + "futures-util", 405 405 + "http", 406 406 + "http-body", 407 407 + "http-body-util", 408 408 + "mime", 409 409 + "pin-project-lite", 410 410 + "rustversion", 411 411 + "serde_core", 412 412 + "tower-layer", 413 413 + "tower-service", 414 414 + "tracing", 415 415 + ] 416 416 + 417 417 + [[package]] 368 418 name = "axum-macros" 369 419 version = "0.5.0" 370 420 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 411 461 412 462 [[package]] 413 463 name = "base64" 464 464 + version = "0.13.1" 465 465 + source = "registry+https://github.com/rust-lang/crates.io-index" 466 466 + checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8" 467 467 + 468 468 + [[package]] 469 469 + name = "base64" 414 470 version = "0.22.1" 415 471 source = "registry+https://github.com/rust-lang/crates.io-index" 416 472 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" ··· 487 543 ] 488 544 489 545 [[package]] 546 546 + name = "brotli" 547 547 + version = "3.5.0" 548 548 + source = "registry+https://github.com/rust-lang/crates.io-index" 549 549 + checksum = "d640d25bc63c50fb1f0b545ffd80207d2e10a4c965530809b40ba3386825c391" 550 550 + dependencies = [ 551 551 + "alloc-no-stdlib", 552 552 + "alloc-stdlib", 553 553 + "brotli-decompressor", 554 554 + ] 555 555 + 556 556 + [[package]] 557 557 + name = "brotli-decompressor" 558 558 + version = "2.5.1" 559 559 + source = "registry+https://github.com/rust-lang/crates.io-index" 560 560 + checksum = "4e2e4afe60d7dd600fdd3de8d0f08c2b7ec039712e3b6137ff98b7004e82de4f" 561 561 + dependencies = [ 562 562 + "alloc-no-stdlib", 563 563 + "alloc-stdlib", 564 564 + ] 565 565 + 566 566 + [[package]] 490 567 name = "bstr" 491 568 version = "1.12.1" 492 569 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 518 595 "cc-traits", 519 596 "slab", 520 597 "smallvec", 598 598 + ] 599 599 + 600 600 + [[package]] 601 601 + name = "buf_redux" 602 602 + version = "0.8.4" 603 603 + source = "registry+https://github.com/rust-lang/crates.io-index" 604 604 + checksum = "b953a6887648bb07a535631f2bc00fbdb2a2216f135552cb3f534ed136b9c07f" 605 605 + dependencies = [ 606 606 + "memchr", 607 607 + "safemem", 521 608 ] 522 609 523 610 [[package]] ··· 572 659 ] 573 660 574 661 [[package]] 662 662 + name = "cesu8" 663 663 + version = "1.1.0" 664 664 + source = "registry+https://github.com/rust-lang/crates.io-index" 665 665 + checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c" 666 666 + 667 667 + [[package]] 575 668 name = "cfg-if" 576 669 version = "1.0.4" 577 670 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 606 699 "hashbrown 0.14.5", 607 700 "stacker", 608 701 ] 702 702 + 703 703 + [[package]] 704 704 + name = "chunked_transfer" 705 705 + version = "1.5.0" 706 706 + source = "registry+https://github.com/rust-lang/crates.io-index" 707 707 + checksum = "6e4de3bc4ea267985becf712dc6d9eed8b04c953b3fcfb339ebc87acd9804901" 609 708 610 709 [[package]] 611 710 name = "ciborium" ··· 677 776 ] 678 777 679 778 [[package]] 779 779 + name = "combine" 780 780 + version = "4.6.7" 781 781 + source = "registry+https://github.com/rust-lang/crates.io-index" 782 782 + checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd" 783 783 + dependencies = [ 784 784 + "bytes", 785 785 + "memchr", 786 786 + ] 787 787 + 788 788 + [[package]] 680 789 name = "compression-codecs" 681 790 version = "0.4.35" 682 791 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 717 826 checksum = "2f421161cb492475f1661ddc9815a745a1c894592070661180fdec3d4872e9c3" 718 827 719 828 [[package]] 829 829 + name = "cookie" 830 830 + version = "0.18.1" 831 831 + source = "registry+https://github.com/rust-lang/crates.io-index" 832 832 + checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747" 833 833 + dependencies = [ 834 834 + "base64 0.22.1", 835 835 + "hmac", 836 836 + "percent-encoding", 837 837 + "rand 0.8.5", 838 838 + "sha2", 839 839 + "subtle", 840 840 + "time", 841 841 + "version_check", 842 842 + ] 843 843 + 844 844 + [[package]] 720 845 name = "cordyceps" 721 846 version = "0.3.4" 722 847 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 731 856 version = "0.9.4" 732 857 source = "registry+https://github.com/rust-lang/crates.io-index" 733 858 checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f" 859 859 + dependencies = [ 860 860 + "core-foundation-sys", 861 861 + "libc", 862 862 + ] 863 863 + 864 864 + [[package]] 865 865 + name = "core-foundation" 866 866 + version = "0.10.1" 867 867 + source = "registry+https://github.com/rust-lang/crates.io-index" 868 868 + checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6" 734 869 dependencies = [ 735 870 "core-foundation-sys", 736 871 "libc", ··· 789 924 version = "1.2.0" 790 925 source = "registry+https://github.com/rust-lang/crates.io-index" 791 926 checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b" 927 927 + 928 928 + [[package]] 929 929 + name = "crossbeam-channel" 930 930 + version = "0.5.15" 931 931 + source = "registry+https://github.com/rust-lang/crates.io-index" 932 932 + checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2" 933 933 + dependencies = [ 934 934 + "crossbeam-utils", 935 935 + ] 792 936 793 937 [[package]] 794 938 name = "crossbeam-queue" ··· 944 1088 ] 945 1089 946 1090 [[package]] 1091 1091 + name = "deflate" 1092 1092 + version = "1.0.0" 1093 1093 + source = "registry+https://github.com/rust-lang/crates.io-index" 1094 1094 + checksum = "c86f7e25f518f4b81808a2cf1c50996a61f5c2eb394b2393bd87f2a4780a432f" 1095 1095 + dependencies = [ 1096 1096 + "adler32", 1097 1097 + "gzip-header", 1098 1098 + ] 1099 1099 + 1100 1100 + [[package]] 947 1101 name = "der" 948 1102 version = "0.7.10" 949 1103 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 1093 1247 checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47" 1094 1248 dependencies = [ 1095 1249 "base16ct", 1250 1250 + "base64ct", 1096 1251 "crypto-bigint", 1097 1252 "digest", 1098 1253 "ff", ··· 1102 1257 "pkcs8", 1103 1258 "rand_core 0.6.4", 1104 1259 "sec1", 1260 1260 + "serde_json", 1261 1261 + "serdect", 1105 1262 "subtle", 1106 1263 "zeroize", 1107 1264 ] ··· 1112 1269 source = "registry+https://github.com/rust-lang/crates.io-index" 1113 1270 checksum = "9298e6504d9b9e780ed3f7dfd43a61be8cd0e09eb07f7706a945b0072b6670b6" 1114 1271 dependencies = [ 1115 1115 - "base64", 1272 1272 + "base64 0.22.1", 1116 1273 "memchr", 1117 1274 ] 1118 1275 ··· 1144 1301 ] 1145 1302 1146 1303 [[package]] 1304 1304 + name = "enum-as-inner" 1305 1305 + version = "0.6.1" 1306 1306 + source = "registry+https://github.com/rust-lang/crates.io-index" 1307 1307 + checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc" 1308 1308 + dependencies = [ 1309 1309 + "heck 0.5.0", 1310 1310 + "proc-macro2", 1311 1311 + "quote", 1312 1312 + "syn 2.0.112", 1313 1313 + ] 1314 1314 + 1315 1315 + [[package]] 1147 1316 name = "equivalent" 1148 1317 version = "1.0.2" 1149 1318 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 1156 1325 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" 1157 1326 dependencies = [ 1158 1327 "libc", 1159 1159 - "windows-sys 0.59.0", 1328 1328 + "windows-sys 0.61.2", 1160 1329 ] 1161 1330 1162 1331 [[package]] ··· 1214 1383 ] 1215 1384 1216 1385 [[package]] 1386 1386 + name = "filetime" 1387 1387 + version = "0.2.27" 1388 1388 + source = "registry+https://github.com/rust-lang/crates.io-index" 1389 1389 + checksum = "f98844151eee8917efc50bd9e8318cb963ae8b297431495d3f758616ea5c57db" 1390 1390 + dependencies = [ 1391 1391 + "cfg-if", 1392 1392 + "libc", 1393 1393 + "libredox", 1394 1394 + ] 1395 1395 + 1396 1396 + [[package]] 1217 1397 name = "find-msvc-tools" 1218 1398 version = "0.1.6" 1219 1399 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 1297 1477 version = "1.3.0" 1298 1478 source = "registry+https://github.com/rust-lang/crates.io-index" 1299 1479 checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c" 1480 1480 + 1481 1481 + [[package]] 1482 1482 + name = "futf" 1483 1483 + version = "0.1.5" 1484 1484 + source = "registry+https://github.com/rust-lang/crates.io-index" 1485 1485 + checksum = "df420e2e84819663797d1ec6544b13c5be84629e7bb00dc960d6917db2987843" 1486 1486 + dependencies = [ 1487 1487 + "mac", 1488 1488 + "new_debug_unreachable", 1489 1489 + ] 1300 1490 1301 1491 [[package]] 1302 1492 name = "futures-buffered" ··· 1468 1658 ] 1469 1659 1470 1660 [[package]] 1661 1661 + name = "getrandom" 1662 1662 + version = "0.4.1" 1663 1663 + source = "registry+https://github.com/rust-lang/crates.io-index" 1664 1664 + checksum = "139ef39800118c7683f2fd3c98c1b23c09ae076556b435f8e9064ae108aaeeec" 1665 1665 + dependencies = [ 1666 1666 + "cfg-if", 1667 1667 + "libc", 1668 1668 + "r-efi", 1669 1669 + "wasip2", 1670 1670 + "wasip3", 1671 1671 + ] 1672 1672 + 1673 1673 + [[package]] 1471 1674 name = "globset" 1472 1675 version = "0.4.18" 1473 1676 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 1481 1684 ] 1482 1685 1483 1686 [[package]] 1687 1687 + name = "gloo-storage" 1688 1688 + version = "0.3.0" 1689 1689 + source = "registry+https://github.com/rust-lang/crates.io-index" 1690 1690 + checksum = "fbc8031e8c92758af912f9bc08fbbadd3c6f3cfcbf6b64cdf3d6a81f0139277a" 1691 1691 + dependencies = [ 1692 1692 + "gloo-utils", 1693 1693 + "js-sys", 1694 1694 + "serde", 1695 1695 + "serde_json", 1696 1696 + "thiserror 1.0.69", 1697 1697 + "wasm-bindgen", 1698 1698 + "web-sys", 1699 1699 + ] 1700 1700 + 1701 1701 + [[package]] 1484 1702 name = "gloo-timers" 1485 1703 version = "0.3.0" 1486 1704 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 1490 1708 "futures-core", 1491 1709 "js-sys", 1492 1710 "wasm-bindgen", 1711 1711 + ] 1712 1712 + 1713 1713 + [[package]] 1714 1714 + name = "gloo-utils" 1715 1715 + version = "0.2.0" 1716 1716 + source = "registry+https://github.com/rust-lang/crates.io-index" 1717 1717 + checksum = "0b5555354113b18c547c1d3a98fbf7fb32a9ff4f6fa112ce823a21641a0ba3aa" 1718 1718 + dependencies = [ 1719 1719 + "js-sys", 1720 1720 + "serde", 1721 1721 + "serde_json", 1722 1722 + "wasm-bindgen", 1723 1723 + "web-sys", 1493 1724 ] 1494 1725 1495 1726 [[package]] ··· 1524 1755 "ff", 1525 1756 "rand_core 0.6.4", 1526 1757 "subtle", 1758 1758 + ] 1759 1759 + 1760 1760 + [[package]] 1761 1761 + name = "gzip-header" 1762 1762 + version = "1.0.0" 1763 1763 + source = "registry+https://github.com/rust-lang/crates.io-index" 1764 1764 + checksum = "95cc527b92e6029a62960ad99aa8a6660faa4555fe5f731aab13aa6a921795a2" 1765 1765 + dependencies = [ 1766 1766 + "crc32fast", 1527 1767 ] 1528 1768 1529 1769 [[package]] ··· 1674 1914 checksum = "b07f60793ff0a4d9cef0f18e63b5357e06209987153a64648c972c1e5aff336f" 1675 1915 1676 1916 [[package]] 1917 1917 + name = "hickory-proto" 1918 1918 + version = "0.24.4" 1919 1919 + source = "registry+https://github.com/rust-lang/crates.io-index" 1920 1920 + checksum = "92652067c9ce6f66ce53cc38d1169daa36e6e7eb7dd3b63b5103bd9d97117248" 1921 1921 + dependencies = [ 1922 1922 + "async-trait", 1923 1923 + "cfg-if", 1924 1924 + "data-encoding", 1925 1925 + "enum-as-inner", 1926 1926 + "futures-channel", 1927 1927 + "futures-io", 1928 1928 + "futures-util", 1929 1929 + "idna", 1930 1930 + "ipnet", 1931 1931 + "once_cell", 1932 1932 + "rand 0.8.5", 1933 1933 + "thiserror 1.0.69", 1934 1934 + "tinyvec", 1935 1935 + "tokio", 1936 1936 + "tracing", 1937 1937 + "url", 1938 1938 + ] 1939 1939 + 1940 1940 + [[package]] 1941 1941 + name = "hickory-resolver" 1942 1942 + version = "0.24.4" 1943 1943 + source = "registry+https://github.com/rust-lang/crates.io-index" 1944 1944 + checksum = "cbb117a1ca520e111743ab2f6688eddee69db4e0ea242545a604dce8a66fd22e" 1945 1945 + dependencies = [ 1946 1946 + "cfg-if", 1947 1947 + "futures-util", 1948 1948 + "hickory-proto", 1949 1949 + "ipconfig", 1950 1950 + "lru-cache", 1951 1951 + "once_cell", 1952 1952 + "parking_lot", 1953 1953 + "rand 0.8.5", 1954 1954 + "resolv-conf", 1955 1955 + "smallvec", 1956 1956 + "thiserror 1.0.69", 1957 1957 + "tokio", 1958 1958 + "tracing", 1959 1959 + ] 1960 1960 + 1961 1961 + [[package]] 1677 1962 name = "hkdf" 1678 1963 version = "0.12.4" 1679 1964 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 1710 1995 ] 1711 1996 1712 1997 [[package]] 1998 1998 + name = "html5ever" 1999 1999 + version = "0.27.0" 2000 2000 + source = "registry+https://github.com/rust-lang/crates.io-index" 2001 2001 + checksum = "c13771afe0e6e846f1e67d038d4cb29998a6779f93c809212e4e9c32efd244d4" 2002 2002 + dependencies = [ 2003 2003 + "log", 2004 2004 + "mac", 2005 2005 + "markup5ever", 2006 2006 + "proc-macro2", 2007 2007 + "quote", 2008 2008 + "syn 2.0.112", 2009 2009 + ] 2010 2010 + 2011 2011 + [[package]] 1713 2012 name = "http" 1714 2013 version = "1.4.0" 1715 2014 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 1813 2112 source = "registry+https://github.com/rust-lang/crates.io-index" 1814 2113 checksum = "727805d60e7938b76b826a6ef209eb70eaa1812794f9424d4a4e2d740662df5f" 1815 2114 dependencies = [ 1816 1816 - "base64", 2115 2115 + "base64 0.22.1", 1817 2116 "bytes", 1818 2117 "futures-channel", 1819 2118 "futures-core", ··· 1825 2124 "libc", 1826 2125 "percent-encoding", 1827 2126 "pin-project-lite", 1828 1828 - "socket2", 2127 2127 + "socket2 0.6.1", 1829 2128 "system-configuration", 1830 2129 "tokio", 1831 2130 "tower-service", ··· 1939 2238 ] 1940 2239 1941 2240 [[package]] 2241 2241 + name = "id-arena" 2242 2242 + version = "2.3.0" 2243 2243 + source = "registry+https://github.com/rust-lang/crates.io-index" 2244 2244 + checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954" 2245 2245 + 2246 2246 + [[package]] 1942 2247 name = "ident_case" 1943 2248 version = "1.0.1" 1944 2249 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2016 2321 ] 2017 2322 2018 2323 [[package]] 2324 2324 + name = "ipconfig" 2325 2325 + version = "0.3.2" 2326 2326 + source = "registry+https://github.com/rust-lang/crates.io-index" 2327 2327 + checksum = "b58db92f96b720de98181bbbe63c831e87005ab460c1bf306eb2622b4707997f" 2328 2328 + dependencies = [ 2329 2329 + "socket2 0.5.10", 2330 2330 + "widestring", 2331 2331 + "windows-sys 0.48.0", 2332 2332 + "winreg", 2333 2333 + ] 2334 2334 + 2335 2335 + [[package]] 2019 2336 name = "ipld-core" 2020 2337 version = "0.4.2" 2021 2338 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2049 2366 checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2" 2050 2367 2051 2368 [[package]] 2369 2369 + name = "jacquard" 2370 2370 + version = "0.9.5" 2371 2371 + source = "registry+https://github.com/rust-lang/crates.io-index" 2372 2372 + checksum = "f7c1fdbcf1153e6e6b87fde20036c1ffe7473c4852f1c6369bc4ef1fe47ccb9f" 2373 2373 + dependencies = [ 2374 2374 + "bytes", 2375 2375 + "getrandom 0.2.16", 2376 2376 + "gloo-storage", 2377 2377 + "http", 2378 2378 + "jacquard-api", 2379 2379 + "jacquard-common", 2380 2380 + "jacquard-derive", 2381 2381 + "jacquard-identity", 2382 2382 + "jacquard-oauth", 2383 2383 + "jose-jwk", 2384 2384 + "miette", 2385 2385 + "regex", 2386 2386 + "regex-lite", 2387 2387 + "reqwest", 2388 2388 + "serde", 2389 2389 + "serde_html_form", 2390 2390 + "serde_json", 2391 2391 + "smol_str", 2392 2392 + "thiserror 2.0.17", 2393 2393 + "tokio", 2394 2394 + "trait-variant", 2395 2395 + "url", 2396 2396 + "webpage", 2397 2397 + ] 2398 2398 + 2399 2399 + [[package]] 2052 2400 name = "jacquard-api" 2053 2401 version = "0.9.5" 2054 2402 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2074 2422 source = "registry+https://github.com/rust-lang/crates.io-index" 2075 2423 checksum = "1751921e0bdae5e0077afade6161545e9ef7698306c868f800916e99ecbcaae9" 2076 2424 dependencies = [ 2077 2077 - "base64", 2425 2425 + "base64 0.22.1", 2078 2426 "bon", 2079 2427 "bytes", 2080 2428 "chrono", ··· 2130 2478 dependencies = [ 2131 2479 "bon", 2132 2480 "bytes", 2481 2481 + "hickory-resolver", 2133 2482 "http", 2134 2483 "jacquard-api", 2135 2484 "jacquard-common", 2136 2485 "jacquard-lexicon", 2137 2486 "miette", 2487 2487 + "mini-moka-wasm", 2138 2488 "n0-future", 2139 2489 "percent-encoding", 2140 2490 "reqwest", ··· 2176 2526 ] 2177 2527 2178 2528 [[package]] 2529 2529 + name = "jacquard-oauth" 2530 2530 + version = "0.9.6" 2531 2531 + source = "registry+https://github.com/rust-lang/crates.io-index" 2532 2532 + checksum = "68bf0b0e061d85b09cfa78588dc098918d5b62f539a719165c6a806a1d2c0ef2" 2533 2533 + dependencies = [ 2534 2534 + "base64 0.22.1", 2535 2535 + "bytes", 2536 2536 + "chrono", 2537 2537 + "dashmap", 2538 2538 + "elliptic-curve", 2539 2539 + "http", 2540 2540 + "jacquard-common", 2541 2541 + "jacquard-identity", 2542 2542 + "jose-jwa", 2543 2543 + "jose-jwk", 2544 2544 + "miette", 2545 2545 + "p256", 2546 2546 + "rand 0.8.5", 2547 2547 + "rouille", 2548 2548 + "serde", 2549 2549 + "serde_html_form", 2550 2550 + "serde_json", 2551 2551 + "sha2", 2552 2552 + "smol_str", 2553 2553 + "thiserror 2.0.17", 2554 2554 + "tokio", 2555 2555 + "trait-variant", 2556 2556 + "url", 2557 2557 + "webbrowser", 2558 2558 + ] 2559 2559 + 2560 2560 + [[package]] 2561 2561 + name = "jni" 2562 2562 + version = "0.21.1" 2563 2563 + source = "registry+https://github.com/rust-lang/crates.io-index" 2564 2564 + checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97" 2565 2565 + dependencies = [ 2566 2566 + "cesu8", 2567 2567 + "cfg-if", 2568 2568 + "combine", 2569 2569 + "jni-sys", 2570 2570 + "log", 2571 2571 + "thiserror 1.0.69", 2572 2572 + "walkdir", 2573 2573 + "windows-sys 0.45.0", 2574 2574 + ] 2575 2575 + 2576 2576 + [[package]] 2577 2577 + name = "jni-sys" 2578 2578 + version = "0.3.0" 2579 2579 + source = "registry+https://github.com/rust-lang/crates.io-index" 2580 2580 + checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130" 2581 2581 + 2582 2582 + [[package]] 2179 2583 name = "jobserver" 2180 2584 version = "0.1.34" 2181 2585 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2186 2590 ] 2187 2591 2188 2592 [[package]] 2593 2593 + name = "jose-b64" 2594 2594 + version = "0.1.2" 2595 2595 + source = "registry+https://github.com/rust-lang/crates.io-index" 2596 2596 + checksum = "bec69375368709666b21c76965ce67549f2d2db7605f1f8707d17c9656801b56" 2597 2597 + dependencies = [ 2598 2598 + "base64ct", 2599 2599 + "serde", 2600 2600 + "subtle", 2601 2601 + "zeroize", 2602 2602 + ] 2603 2603 + 2604 2604 + [[package]] 2605 2605 + name = "jose-jwa" 2606 2606 + version = "0.1.2" 2607 2607 + source = "registry+https://github.com/rust-lang/crates.io-index" 2608 2608 + checksum = "9ab78e053fe886a351d67cf0d194c000f9d0dcb92906eb34d853d7e758a4b3a7" 2609 2609 + dependencies = [ 2610 2610 + "serde", 2611 2611 + ] 2612 2612 + 2613 2613 + [[package]] 2614 2614 + name = "jose-jwk" 2615 2615 + version = "0.1.2" 2616 2616 + source = "registry+https://github.com/rust-lang/crates.io-index" 2617 2617 + checksum = "280fa263807fe0782ecb6f2baadc28dffc04e00558a58e33bfdb801d11fd58e7" 2618 2618 + dependencies = [ 2619 2619 + "jose-b64", 2620 2620 + "jose-jwa", 2621 2621 + "p256", 2622 2622 + "p384", 2623 2623 + "rsa", 2624 2624 + "serde", 2625 2625 + "zeroize", 2626 2626 + ] 2627 2627 + 2628 2628 + [[package]] 2189 2629 name = "josekit" 2190 2630 version = "0.10.3" 2191 2631 source = "registry+https://github.com/rust-lang/crates.io-index" 2192 2632 checksum = "a808e078330e6af222eb0044b71d4b1ff981bfef43e7bc8133a88234e0c86a0c" 2193 2633 dependencies = [ 2194 2634 "anyhow", 2195 2195 - "base64", 2635 2635 + "base64 0.22.1", 2196 2636 "flate2", 2197 2637 "openssl", 2198 2638 "regex", ··· 2276 2716 ] 2277 2717 2278 2718 [[package]] 2719 2719 + name = "leb128fmt" 2720 2720 + version = "0.1.0" 2721 2721 + source = "registry+https://github.com/rust-lang/crates.io-index" 2722 2722 + checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2" 2723 2723 + 2724 2724 + [[package]] 2279 2725 name = "lettre" 2280 2726 version = "0.11.19" 2281 2727 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2283 2729 dependencies = [ 2284 2730 "async-std", 2285 2731 "async-trait", 2286 2286 - "base64", 2732 2732 + "base64 0.22.1", 2287 2733 "chumsky", 2288 2734 "email-encoding", 2289 2735 "email_address", ··· 2297 2743 "percent-encoding", 2298 2744 "quoted_printable", 2299 2745 "rustls", 2300 2300 - "socket2", 2746 2746 + "socket2 0.6.1", 2301 2747 "tokio", 2302 2748 "tokio-rustls", 2303 2749 "url", ··· 2339 2785 ] 2340 2786 2341 2787 [[package]] 2788 2788 + name = "linked-hash-map" 2789 2789 + version = "0.5.6" 2790 2790 + source = "registry+https://github.com/rust-lang/crates.io-index" 2791 2791 + checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f" 2792 2792 + 2793 2793 + [[package]] 2342 2794 name = "linux-raw-sys" 2343 2795 version = "0.11.0" 2344 2796 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2382 2834 ] 2383 2835 2384 2836 [[package]] 2837 2837 + name = "lru-cache" 2838 2838 + version = "0.1.2" 2839 2839 + source = "registry+https://github.com/rust-lang/crates.io-index" 2840 2840 + checksum = "31e24f1ad8321ca0e8a1e0ac13f23cb668e6f5466c2c57319f6a5cf1cc8e3b1c" 2841 2841 + dependencies = [ 2842 2842 + "linked-hash-map", 2843 2843 + ] 2844 2844 + 2845 2845 + [[package]] 2385 2846 name = "lru-slab" 2386 2847 version = "0.1.2" 2387 2848 source = "registry+https://github.com/rust-lang/crates.io-index" 2388 2849 checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154" 2850 2850 + 2851 2851 + [[package]] 2852 2852 + name = "mac" 2853 2853 + version = "0.1.1" 2854 2854 + source = "registry+https://github.com/rust-lang/crates.io-index" 2855 2855 + checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4" 2856 2856 + 2857 2857 + [[package]] 2858 2858 + name = "markup5ever" 2859 2859 + version = "0.12.1" 2860 2860 + source = "registry+https://github.com/rust-lang/crates.io-index" 2861 2861 + checksum = "16ce3abbeba692c8b8441d036ef91aea6df8da2c6b6e21c7e14d3c18e526be45" 2862 2862 + dependencies = [ 2863 2863 + "log", 2864 2864 + "phf", 2865 2865 + "phf_codegen", 2866 2866 + "string_cache", 2867 2867 + "string_cache_codegen", 2868 2868 + "tendril", 2869 2869 + ] 2870 2870 + 2871 2871 + [[package]] 2872 2872 + name = "markup5ever_rcdom" 2873 2873 + version = "0.3.0" 2874 2874 + source = "registry+https://github.com/rust-lang/crates.io-index" 2875 2875 + checksum = "edaa21ab3701bfee5099ade5f7e1f84553fd19228cf332f13cd6e964bf59be18" 2876 2876 + dependencies = [ 2877 2877 + "html5ever", 2878 2878 + "markup5ever", 2879 2879 + "tendril", 2880 2880 + "xml5ever", 2881 2881 + ] 2389 2882 2390 2883 [[package]] 2391 2884 name = "match-lookup" ··· 2458 2951 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a" 2459 2952 2460 2953 [[package]] 2954 2954 + name = "mime_guess" 2955 2955 + version = "2.0.5" 2956 2956 + source = "registry+https://github.com/rust-lang/crates.io-index" 2957 2957 + checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e" 2958 2958 + dependencies = [ 2959 2959 + "mime", 2960 2960 + "unicase", 2961 2961 + ] 2962 2962 + 2963 2963 + [[package]] 2964 2964 + name = "mini-moka-wasm" 2965 2965 + version = "0.10.99" 2966 2966 + source = "registry+https://github.com/rust-lang/crates.io-index" 2967 2967 + checksum = "0102b9a2ad50fa47ca89eead2316c8222285ecfbd3f69ce99564fbe4253866e8" 2968 2968 + dependencies = [ 2969 2969 + "crossbeam-channel", 2970 2970 + "crossbeam-utils", 2971 2971 + "dashmap", 2972 2972 + "smallvec", 2973 2973 + "tagptr", 2974 2974 + "triomphe", 2975 2975 + "web-time", 2976 2976 + ] 2977 2977 + 2978 2978 + [[package]] 2461 2979 name = "minimal-lexical" 2462 2980 version = "0.2.1" 2463 2981 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2508 3026 ] 2509 3027 2510 3028 [[package]] 3029 3029 + name = "multipart" 3030 3030 + version = "0.18.0" 3031 3031 + source = "registry+https://github.com/rust-lang/crates.io-index" 3032 3032 + checksum = "00dec633863867f29cb39df64a397cdf4a6354708ddd7759f70c7fb51c5f9182" 3033 3033 + dependencies = [ 3034 3034 + "buf_redux", 3035 3035 + "httparse", 3036 3036 + "log", 3037 3037 + "mime", 3038 3038 + "mime_guess", 3039 3039 + "quick-error", 3040 3040 + "rand 0.8.5", 3041 3041 + "safemem", 3042 3042 + "tempfile", 3043 3043 + "twoway", 3044 3044 + ] 3045 3045 + 3046 3046 + [[package]] 2511 3047 name = "n0-future" 2512 3048 version = "0.1.3" 2513 3049 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2527 3063 "wasm-bindgen-futures", 2528 3064 "web-time", 2529 3065 ] 3066 3066 + 3067 3067 + [[package]] 3068 3068 + name = "ndk-context" 3069 3069 + version = "0.1.1" 3070 3070 + source = "registry+https://github.com/rust-lang/crates.io-index" 3071 3071 + checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b" 3072 3072 + 3073 3073 + [[package]] 3074 3074 + name = "new_debug_unreachable" 3075 3075 + version = "1.0.6" 3076 3076 + source = "registry+https://github.com/rust-lang/crates.io-index" 3077 3077 + checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086" 2530 3078 2531 3079 [[package]] 2532 3080 name = "nom" ··· 2565 3113 source = "registry+https://github.com/rust-lang/crates.io-index" 2566 3114 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" 2567 3115 dependencies = [ 2568 2568 - "windows-sys 0.59.0", 3116 3116 + "windows-sys 0.61.2", 2569 3117 ] 2570 3118 2571 3119 [[package]] ··· 2636 3184 ] 2637 3185 2638 3186 [[package]] 3187 3187 + name = "num_cpus" 3188 3188 + version = "1.17.0" 3189 3189 + source = "registry+https://github.com/rust-lang/crates.io-index" 3190 3190 + checksum = "91df4bbde75afed763b708b7eee1e8e7651e02d97f6d5dd763e89367e957b23b" 3191 3191 + dependencies = [ 3192 3192 + "hermit-abi", 3193 3193 + "libc", 3194 3194 + ] 3195 3195 + 3196 3196 + [[package]] 3197 3197 + name = "num_threads" 3198 3198 + version = "0.1.7" 3199 3199 + source = "registry+https://github.com/rust-lang/crates.io-index" 3200 3200 + checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9" 3201 3201 + dependencies = [ 3202 3202 + "libc", 3203 3203 + ] 3204 3204 + 3205 3205 + [[package]] 3206 3206 + name = "objc2" 3207 3207 + version = "0.6.4" 3208 3208 + source = "registry+https://github.com/rust-lang/crates.io-index" 3209 3209 + checksum = "3a12a8ed07aefc768292f076dc3ac8c48f3781c8f2d5851dd3d98950e8c5a89f" 3210 3210 + dependencies = [ 3211 3211 + "objc2-encode", 3212 3212 + ] 3213 3213 + 3214 3214 + [[package]] 3215 3215 + name = "objc2-encode" 3216 3216 + version = "4.1.0" 3217 3217 + source = "registry+https://github.com/rust-lang/crates.io-index" 3218 3218 + checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33" 3219 3219 + 3220 3220 + [[package]] 3221 3221 + name = "objc2-foundation" 3222 3222 + version = "0.3.2" 3223 3223 + source = "registry+https://github.com/rust-lang/crates.io-index" 3224 3224 + checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272" 3225 3225 + dependencies = [ 3226 3226 + "bitflags", 3227 3227 + "objc2", 3228 3228 + ] 3229 3229 + 3230 3230 + [[package]] 2639 3231 name = "object" 2640 3232 version = "0.32.2" 2641 3233 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2725 3317 ] 2726 3318 2727 3319 [[package]] 3320 3320 + name = "p384" 3321 3321 + version = "0.13.1" 3322 3322 + source = "registry+https://github.com/rust-lang/crates.io-index" 3323 3323 + checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6" 3324 3324 + dependencies = [ 3325 3325 + "elliptic-curve", 3326 3326 + "primeorder", 3327 3327 + ] 3328 3328 + 3329 3329 + [[package]] 2728 3330 name = "parking" 2729 3331 version = "2.2.1" 2730 3332 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2781 3383 "anyhow", 2782 3384 "aws-lc-rs", 2783 3385 "axum", 3386 3386 + "axum-extra", 2784 3387 "axum-template", 3388 3388 + "base64 0.22.1", 2785 3389 "chrono", 2786 3390 "dashmap", 2787 3391 "dotenvy", ··· 2789 3393 "hex", 2790 3394 "html-escape", 2791 3395 "hyper-util", 3396 3396 + "jacquard", 3397 3397 + "jacquard-api", 2792 3398 "jacquard-common", 2793 3399 "jacquard-identity", 3400 3400 + "jacquard-oauth", 3401 3401 + "jose-jwk", 2794 3402 "josekit", 2795 3403 "jwt-compact", 2796 3404 "lettre", 2797 3405 "multibase", 3406 3406 + "p256", 2798 3407 "rand 0.9.2", 2799 3408 "reqwest", 2800 3409 "rust-embed", ··· 2802 3411 "scrypt", 2803 3412 "serde", 2804 3413 "serde_json", 3414 3414 + "serde_yaml", 2805 3415 "sha2", 2806 3416 "sqlx", 2807 3417 "tokio", ··· 2812 3422 "tracing-subscriber", 2813 3423 "url", 2814 3424 "urlencoding", 2815 2815 - "valuable", 3425 3425 + "uuid", 2816 3426 ] 2817 3427 2818 3428 [[package]] ··· 2874 3484 ] 2875 3485 2876 3486 [[package]] 3487 3487 + name = "phf" 3488 3488 + version = "0.11.3" 3489 3489 + source = "registry+https://github.com/rust-lang/crates.io-index" 3490 3490 + checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078" 3491 3491 + dependencies = [ 3492 3492 + "phf_shared", 3493 3493 + ] 3494 3494 + 3495 3495 + [[package]] 3496 3496 + name = "phf_codegen" 3497 3497 + version = "0.11.3" 3498 3498 + source = "registry+https://github.com/rust-lang/crates.io-index" 3499 3499 + checksum = "aef8048c789fa5e851558d709946d6d79a8ff88c0440c587967f8e94bfb1216a" 3500 3500 + dependencies = [ 3501 3501 + "phf_generator", 3502 3502 + "phf_shared", 3503 3503 + ] 3504 3504 + 3505 3505 + [[package]] 3506 3506 + name = "phf_generator" 3507 3507 + version = "0.11.3" 3508 3508 + source = "registry+https://github.com/rust-lang/crates.io-index" 3509 3509 + checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d" 3510 3510 + dependencies = [ 3511 3511 + "phf_shared", 3512 3512 + "rand 0.8.5", 3513 3513 + ] 3514 3514 + 3515 3515 + [[package]] 3516 3516 + name = "phf_shared" 3517 3517 + version = "0.11.3" 3518 3518 + source = "registry+https://github.com/rust-lang/crates.io-index" 3519 3519 + checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5" 3520 3520 + dependencies = [ 3521 3521 + "siphasher", 3522 3522 + ] 3523 3523 + 3524 3524 + [[package]] 2877 3525 name = "pin-project" 2878 3526 version = "1.1.10" 2879 3527 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 3001 3649 ] 3002 3650 3003 3651 [[package]] 3652 3652 + name = "precomputed-hash" 3653 3653 + version = "0.1.1" 3654 3654 + source = "registry+https://github.com/rust-lang/crates.io-index" 3655 3655 + checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c" 3656 3656 + 3657 3657 + [[package]] 3004 3658 name = "prettyplease" 3005 3659 version = "0.2.37" 3006 3660 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 3091 3745 ] 3092 3746 3093 3747 [[package]] 3748 3748 + name = "quick-error" 3749 3749 + version = "1.2.3" 3750 3750 + source = "registry+https://github.com/rust-lang/crates.io-index" 3751 3751 + checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0" 3752 3752 + 3753 3753 + [[package]] 3094 3754 name = "quinn" 3095 3755 version = "0.11.9" 3096 3756 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 3103 3763 "quinn-udp", 3104 3764 "rustc-hash", 3105 3765 "rustls", 3106 3106 - "socket2", 3766 3766 + "socket2 0.6.1", 3107 3767 "thiserror 2.0.17", 3108 3768 "tokio", 3109 3769 "tracing", ··· 3140 3800 "cfg_aliases", 3141 3801 "libc", 3142 3802 "once_cell", 3143 3143 - "socket2", 3803 3803 + "socket2 0.6.1", 3144 3804 "tracing", 3145 3145 - "windows-sys 0.59.0", 3805 3805 + "windows-sys 0.60.2", 3146 3806 ] 3147 3807 3148 3808 [[package]] ··· 3319 3979 source = "registry+https://github.com/rust-lang/crates.io-index" 3320 3980 checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147" 3321 3981 dependencies = [ 3322 3322 - "base64", 3982 3982 + "base64 0.22.1", 3323 3983 "bytes", 3324 3984 "encoding_rs", 3325 3985 "futures-core", ··· 3353 4013 "web-sys", 3354 4014 "webpki-roots 1.0.5", 3355 4015 ] 4016 4016 + 4017 4017 + [[package]] 4018 4018 + name = "resolv-conf" 4019 4019 + version = "0.7.6" 4020 4020 + source = "registry+https://github.com/rust-lang/crates.io-index" 4021 4021 + checksum = "1e061d1b48cb8d38042de4ae0a7a6401009d6143dc80d2e2d6f31f0bdd6470c7" 3356 4022 3357 4023 [[package]] 3358 4024 name = "rfc6979" ··· 3379 4045 ] 3380 4046 3381 4047 [[package]] 4048 4048 + name = "rouille" 4049 4049 + version = "3.6.2" 4050 4050 + source = "registry+https://github.com/rust-lang/crates.io-index" 4051 4051 + checksum = "3716fbf57fc1084d7a706adf4e445298d123e4a44294c4e8213caf1b85fcc921" 4052 4052 + dependencies = [ 4053 4053 + "base64 0.13.1", 4054 4054 + "brotli", 4055 4055 + "chrono", 4056 4056 + "deflate", 4057 4057 + "filetime", 4058 4058 + "multipart", 4059 4059 + "percent-encoding", 4060 4060 + "rand 0.8.5", 4061 4061 + "serde", 4062 4062 + "serde_derive", 4063 4063 + "serde_json", 4064 4064 + "sha1_smol", 4065 4065 + "threadpool", 4066 4066 + "time", 4067 4067 + "tiny_http", 4068 4068 + "url", 4069 4069 + ] 4070 4070 + 4071 4071 + [[package]] 3382 4072 name = "rsa" 3383 4073 version = "0.9.9" 3384 4074 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 3458 4148 "errno", 3459 4149 "libc", 3460 4150 "linux-raw-sys", 3461 3461 - "windows-sys 0.52.0", 4151 4151 + "windows-sys 0.61.2", 3462 4152 ] 3463 4153 3464 4154 [[package]] ··· 3512 4202 checksum = "a50f4cf475b65d88e057964e0e9bb1f0aa9bbb2036dc65c64596b42932536984" 3513 4203 3514 4204 [[package]] 4205 4205 + name = "safemem" 4206 4206 + version = "0.3.3" 4207 4207 + source = "registry+https://github.com/rust-lang/crates.io-index" 4208 4208 + checksum = "ef703b7cb59335eae2eb93ceb664c0eb7ea6bf567079d843e09420219668e072" 4209 4209 + 4210 4210 + [[package]] 3515 4211 name = "salsa20" 3516 4212 version = "0.10.2" 3517 4213 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 3587 4283 "der", 3588 4284 "generic-array", 3589 4285 "pkcs8", 4286 4286 + "serdect", 3590 4287 "subtle", 3591 4288 "zeroize", 3592 4289 ] ··· 3740 4437 source = "registry+https://github.com/rust-lang/crates.io-index" 3741 4438 checksum = "4fa237f2807440d238e0364a218270b98f767a00d3dada77b1c53ae88940e2e7" 3742 4439 dependencies = [ 3743 3743 - "base64", 4440 4440 + "base64 0.22.1", 3744 4441 "chrono", 3745 4442 "hex", 3746 4443 "indexmap 1.9.3", ··· 3766 4463 ] 3767 4464 3768 4465 [[package]] 4466 4466 + name = "serde_yaml" 4467 4467 + version = "0.9.34+deprecated" 4468 4468 + source = "registry+https://github.com/rust-lang/crates.io-index" 4469 4469 + checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47" 4470 4470 + dependencies = [ 4471 4471 + "indexmap 2.12.1", 4472 4472 + "itoa", 4473 4473 + "ryu", 4474 4474 + "serde", 4475 4475 + "unsafe-libyaml", 4476 4476 + ] 4477 4477 + 4478 4478 + [[package]] 4479 4479 + name = "serdect" 4480 4480 + version = "0.2.0" 4481 4481 + source = "registry+https://github.com/rust-lang/crates.io-index" 4482 4482 + checksum = "a84f14a19e9a014bb9f4512488d9829a68e04ecabffb0f9904cd1ace94598177" 4483 4483 + dependencies = [ 4484 4484 + "base16ct", 4485 4485 + "serde", 4486 4486 + ] 4487 4487 + 4488 4488 + [[package]] 3769 4489 name = "sha1" 3770 4490 version = "0.10.6" 3771 4491 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 3775 4495 "cpufeatures", 3776 4496 "digest", 3777 4497 ] 4498 4498 + 4499 4499 + [[package]] 4500 4500 + name = "sha1_smol" 4501 4501 + version = "1.0.1" 4502 4502 + source = "registry+https://github.com/rust-lang/crates.io-index" 4503 4503 + checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d" 3778 4504 3779 4505 [[package]] 3780 4506 name = "sha2" ··· 3829 4555 checksum = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1cb8f047f75a8aeaf8da139da2" 3830 4556 3831 4557 [[package]] 4558 4558 + name = "siphasher" 4559 4559 + version = "1.0.2" 4560 4560 + source = "registry+https://github.com/rust-lang/crates.io-index" 4561 4561 + checksum = "b2aa850e253778c88a04c3d7323b043aeda9d3e30d5971937c1855769763678e" 4562 4562 + 4563 4563 + [[package]] 3832 4564 name = "slab" 3833 4565 version = "0.4.11" 3834 4566 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 3855 4587 3856 4588 [[package]] 3857 4589 name = "socket2" 4590 4590 + version = "0.5.10" 4591 4591 + source = "registry+https://github.com/rust-lang/crates.io-index" 4592 4592 + checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678" 4593 4593 + dependencies = [ 4594 4594 + "libc", 4595 4595 + "windows-sys 0.52.0", 4596 4596 + ] 4597 4597 + 4598 4598 + [[package]] 4599 4599 + name = "socket2" 3858 4600 version = "0.6.1" 3859 4601 source = "registry+https://github.com/rust-lang/crates.io-index" 3860 4602 checksum = "17129e116933cf371d018bb80ae557e889637989d8638274fb25622827b03881" ··· 3916 4658 source = "registry+https://github.com/rust-lang/crates.io-index" 3917 4659 checksum = "ee6798b1838b6a0f69c007c133b8df5866302197e404e8b6ee8ed3e3a5e68dc6" 3918 4660 dependencies = [ 3919 3919 - "base64", 4661 4661 + "base64 0.22.1", 3920 4662 "bytes", 3921 4663 "chrono", 3922 4664 "crc", ··· 3992 4734 checksum = "aa003f0038df784eb8fecbbac13affe3da23b45194bd57dba231c8f48199c526" 3993 4735 dependencies = [ 3994 4736 "atoi", 3995 3995 - "base64", 4737 4737 + "base64 0.22.1", 3996 4738 "bitflags", 3997 4739 "byteorder", 3998 4740 "bytes", ··· 4035 4777 checksum = "db58fcd5a53cf07c184b154801ff91347e4c30d17a3562a635ff028ad5deda46" 4036 4778 dependencies = [ 4037 4779 "atoi", 4038 4038 - "base64", 4780 4780 + "base64 0.22.1", 4039 4781 "bitflags", 4040 4782 "byteorder", 4041 4783 "chrono", ··· 4137 4879 checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f" 4138 4880 4139 4881 [[package]] 4882 4882 + name = "string_cache" 4883 4883 + version = "0.8.9" 4884 4884 + source = "registry+https://github.com/rust-lang/crates.io-index" 4885 4885 + checksum = "bf776ba3fa74f83bf4b63c3dcbbf82173db2632ed8452cb2d891d33f459de70f" 4886 4886 + dependencies = [ 4887 4887 + "new_debug_unreachable", 4888 4888 + "parking_lot", 4889 4889 + "phf_shared", 4890 4890 + "precomputed-hash", 4891 4891 + "serde", 4892 4892 + ] 4893 4893 + 4894 4894 + [[package]] 4895 4895 + name = "string_cache_codegen" 4896 4896 + version = "0.5.4" 4897 4897 + source = "registry+https://github.com/rust-lang/crates.io-index" 4898 4898 + checksum = "c711928715f1fe0fe509c53b43e993a9a557babc2d0a3567d0a3006f1ac931a0" 4899 4899 + dependencies = [ 4900 4900 + "phf_generator", 4901 4901 + "phf_shared", 4902 4902 + "proc-macro2", 4903 4903 + "quote", 4904 4904 + ] 4905 4905 + 4906 4906 + [[package]] 4140 4907 name = "stringprep" 4141 4908 version = "0.1.5" 4142 4909 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 4208 4975 checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b" 4209 4976 dependencies = [ 4210 4977 "bitflags", 4211 4211 - "core-foundation", 4978 4978 + "core-foundation 0.9.4", 4212 4979 "system-configuration-sys", 4213 4980 ] 4214 4981 ··· 4223 4990 ] 4224 4991 4225 4992 [[package]] 4993 4993 + name = "tagptr" 4994 4994 + version = "0.2.0" 4995 4995 + source = "registry+https://github.com/rust-lang/crates.io-index" 4996 4996 + checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417" 4997 4997 + 4998 4998 + [[package]] 4999 4999 + name = "tempfile" 5000 5000 + version = "3.25.0" 5001 5001 + source = "registry+https://github.com/rust-lang/crates.io-index" 5002 5002 + checksum = "0136791f7c95b1f6dd99f9cc786b91bb81c3800b639b3478e561ddb7be95e5f1" 5003 5003 + dependencies = [ 5004 5004 + "fastrand", 5005 5005 + "getrandom 0.4.1", 5006 5006 + "once_cell", 5007 5007 + "rustix", 5008 5008 + "windows-sys 0.61.2", 5009 5009 + ] 5010 5010 + 5011 5011 + [[package]] 5012 5012 + name = "tendril" 5013 5013 + version = "0.4.3" 5014 5014 + source = "registry+https://github.com/rust-lang/crates.io-index" 5015 5015 + checksum = "d24a120c5fc464a3458240ee02c299ebcb9d67b5249c8848b09d639dca8d7bb0" 5016 5016 + dependencies = [ 5017 5017 + "futf", 5018 5018 + "mac", 5019 5019 + "utf-8", 5020 5020 + ] 5021 5021 + 5022 5022 + [[package]] 4226 5023 name = "thiserror" 4227 5024 version = "1.0.69" 4228 5025 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 4272 5069 ] 4273 5070 4274 5071 [[package]] 5072 5072 + name = "threadpool" 5073 5073 + version = "1.8.1" 5074 5074 + source = "registry+https://github.com/rust-lang/crates.io-index" 5075 5075 + checksum = "d050e60b33d41c19108b32cea32164033a9013fe3b46cbd4457559bfbf77afaa" 5076 5076 + dependencies = [ 5077 5077 + "num_cpus", 5078 5078 + ] 5079 5079 + 5080 5080 + [[package]] 4275 5081 name = "time" 4276 5082 version = "0.3.44" 4277 5083 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 4279 5085 dependencies = [ 4280 5086 "deranged", 4281 5087 "itoa", 5088 5088 + "libc", 4282 5089 "num-conv", 5090 5090 + "num_threads", 4283 5091 "powerfmt", 4284 5092 "serde", 4285 5093 "time-core", ··· 4303 5111 ] 4304 5112 4305 5113 [[package]] 5114 5114 + name = "tiny_http" 5115 5115 + version = "0.12.0" 5116 5116 + source = "registry+https://github.com/rust-lang/crates.io-index" 5117 5117 + checksum = "389915df6413a2e74fb181895f933386023c71110878cd0825588928e64cdc82" 5118 5118 + dependencies = [ 5119 5119 + "ascii", 5120 5120 + "chunked_transfer", 5121 5121 + "httpdate", 5122 5122 + "log", 5123 5123 + ] 5124 5124 + 5125 5125 + [[package]] 4306 5126 name = "tinystr" 4307 5127 version = "0.8.2" 4308 5128 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 4338 5158 "mio", 4339 5159 "pin-project-lite", 4340 5160 "signal-hook-registry", 4341 4341 - "socket2", 5161 5161 + "socket2 0.6.1", 4342 5162 "tokio-macros", 4343 5163 "windows-sys 0.61.2", 4344 5164 ] ··· 4397 5217 dependencies = [ 4398 5218 "async-trait", 4399 5219 "axum", 4400 4400 - "base64", 5220 5220 + "base64 0.22.1", 4401 5221 "bytes", 4402 5222 "h2", 4403 5223 "http", ··· 4408 5228 "hyper-util", 4409 5229 "percent-encoding", 4410 5230 "pin-project", 4411 4411 - "socket2", 5231 5231 + "socket2 0.6.1", 4412 5232 "sync_wrapper", 4413 5233 "tokio", 4414 5234 "tokio-stream", ··· 4577 5397 ] 4578 5398 4579 5399 [[package]] 5400 5400 + name = "triomphe" 5401 5401 + version = "0.1.15" 5402 5402 + source = "registry+https://github.com/rust-lang/crates.io-index" 5403 5403 + checksum = "dd69c5aa8f924c7519d6372789a74eac5b94fb0f8fcf0d4a97eb0bfc3e785f39" 5404 5404 + 5405 5405 + [[package]] 4580 5406 name = "try-lock" 4581 5407 version = "0.2.5" 4582 5408 source = "registry+https://github.com/rust-lang/crates.io-index" 4583 5409 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b" 4584 5410 4585 5411 [[package]] 5412 5412 + name = "twoway" 5413 5413 + version = "0.1.8" 5414 5414 + source = "registry+https://github.com/rust-lang/crates.io-index" 5415 5415 + checksum = "59b11b2b5241ba34be09c3cc85a36e56e48f9888862e19cedf23336d35316ed1" 5416 5416 + dependencies = [ 5417 5417 + "memchr", 5418 5418 + ] 5419 5419 + 5420 5420 + [[package]] 4586 5421 name = "typenum" 4587 5422 version = "1.19.0" 4588 5423 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 4595 5430 checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971" 4596 5431 4597 5432 [[package]] 5433 5433 + name = "unicase" 5434 5434 + version = "2.9.0" 5435 5435 + source = "registry+https://github.com/rust-lang/crates.io-index" 5436 5436 + checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142" 5437 5437 + 5438 5438 + [[package]] 4598 5439 name = "unicode-bidi" 4599 5440 version = "0.3.18" 4600 5441 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 4640 5481 checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853" 4641 5482 4642 5483 [[package]] 5484 5484 + name = "unsafe-libyaml" 5485 5485 + version = "0.2.11" 5486 5486 + source = "registry+https://github.com/rust-lang/crates.io-index" 5487 5487 + checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861" 5488 5488 + 5489 5489 + [[package]] 4643 5490 name = "unsigned-varint" 4644 5491 version = "0.8.0" 4645 5492 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 4676 5523 checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da" 4677 5524 4678 5525 [[package]] 5526 5526 + name = "utf-8" 5527 5527 + version = "0.7.6" 5528 5528 + source = "registry+https://github.com/rust-lang/crates.io-index" 5529 5529 + checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9" 5530 5530 + 5531 5531 + [[package]] 4679 5532 name = "utf8-width" 4680 5533 version = "0.1.8" 4681 5534 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 4686 5539 version = "1.0.4" 4687 5540 source = "registry+https://github.com/rust-lang/crates.io-index" 4688 5541 checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be" 5542 5542 + 5543 5543 + [[package]] 5544 5544 + name = "uuid" 5545 5545 + version = "1.21.0" 5546 5546 + source = "registry+https://github.com/rust-lang/crates.io-index" 5547 5547 + checksum = "b672338555252d43fd2240c714dc444b8c6fb0a5c5335e65a07bba7742735ddb" 5548 5548 + dependencies = [ 5549 5549 + "getrandom 0.4.1", 5550 5550 + "js-sys", 5551 5551 + "wasm-bindgen", 5552 5552 + ] 4689 5553 4690 5554 [[package]] 4691 5555 name = "valuable" ··· 4742 5606 source = "registry+https://github.com/rust-lang/crates.io-index" 4743 5607 checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7" 4744 5608 dependencies = [ 4745 4745 - "wit-bindgen", 5609 5609 + "wit-bindgen 0.46.0", 5610 5610 + ] 5611 5611 + 5612 5612 + [[package]] 5613 5613 + name = "wasip3" 5614 5614 + version = "0.4.0+wasi-0.3.0-rc-2026-01-06" 5615 5615 + source = "registry+https://github.com/rust-lang/crates.io-index" 5616 5616 + checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5" 5617 5617 + dependencies = [ 5618 5618 + "wit-bindgen 0.51.0", 4746 5619 ] 4747 5620 4748 5621 [[package]] ··· 4810 5683 ] 4811 5684 4812 5685 [[package]] 5686 5686 + name = "wasm-encoder" 5687 5687 + version = "0.244.0" 5688 5688 + source = "registry+https://github.com/rust-lang/crates.io-index" 5689 5689 + checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319" 5690 5690 + dependencies = [ 5691 5691 + "leb128fmt", 5692 5692 + "wasmparser", 5693 5693 + ] 5694 5694 + 5695 5695 + [[package]] 5696 5696 + name = "wasm-metadata" 5697 5697 + version = "0.244.0" 5698 5698 + source = "registry+https://github.com/rust-lang/crates.io-index" 5699 5699 + checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909" 5700 5700 + dependencies = [ 5701 5701 + "anyhow", 5702 5702 + "indexmap 2.12.1", 5703 5703 + "wasm-encoder", 5704 5704 + "wasmparser", 5705 5705 + ] 5706 5706 + 5707 5707 + [[package]] 5708 5708 + name = "wasmparser" 5709 5709 + version = "0.244.0" 5710 5710 + source = "registry+https://github.com/rust-lang/crates.io-index" 5711 5711 + checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe" 5712 5712 + dependencies = [ 5713 5713 + "bitflags", 5714 5714 + "hashbrown 0.15.5", 5715 5715 + "indexmap 2.12.1", 5716 5716 + "semver", 5717 5717 + ] 5718 5718 + 5719 5719 + [[package]] 4813 5720 name = "web-sys" 4814 5721 version = "0.3.83" 4815 5722 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 4830 5737 ] 4831 5738 4832 5739 [[package]] 5740 5740 + name = "webbrowser" 5741 5741 + version = "1.1.0" 5742 5742 + source = "registry+https://github.com/rust-lang/crates.io-index" 5743 5743 + checksum = "3f00bb839c1cf1e3036066614cbdcd035ecf215206691ea646aa3c60a24f68f2" 5744 5744 + dependencies = [ 5745 5745 + "core-foundation 0.10.1", 5746 5746 + "jni", 5747 5747 + "log", 5748 5748 + "ndk-context", 5749 5749 + "objc2", 5750 5750 + "objc2-foundation", 5751 5751 + "url", 5752 5752 + "web-sys", 5753 5753 + ] 5754 5754 + 5755 5755 + [[package]] 5756 5756 + name = "webpage" 5757 5757 + version = "2.0.1" 5758 5758 + source = "registry+https://github.com/rust-lang/crates.io-index" 5759 5759 + checksum = "70862efc041d46e6bbaa82bb9c34ae0596d090e86cbd14bd9e93b36ee6802eac" 5760 5760 + dependencies = [ 5761 5761 + "html5ever", 5762 5762 + "markup5ever_rcdom", 5763 5763 + "serde_json", 5764 5764 + "url", 5765 5765 + ] 5766 5766 + 5767 5767 + [[package]] 4833 5768 name = "webpki-roots" 4834 5769 version = "0.26.11" 4835 5770 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 4858 5793 ] 4859 5794 4860 5795 [[package]] 5796 5796 + name = "widestring" 5797 5797 + version = "1.2.1" 5798 5798 + source = "registry+https://github.com/rust-lang/crates.io-index" 5799 5799 + checksum = "72069c3113ab32ab29e5584db3c6ec55d416895e60715417b5b883a357c3e471" 5800 5800 + 5801 5801 + [[package]] 4861 5802 name = "winapi" 4862 5803 version = "0.3.9" 4863 5804 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 4879 5820 source = "registry+https://github.com/rust-lang/crates.io-index" 4880 5821 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" 4881 5822 dependencies = [ 4882 4882 - "windows-sys 0.48.0", 5823 5823 + "windows-sys 0.61.2", 4883 5824 ] 4884 5825 4885 5826 [[package]] ··· 4960 5901 4961 5902 [[package]] 4962 5903 name = "windows-sys" 5904 5904 + version = "0.45.0" 5905 5905 + source = "registry+https://github.com/rust-lang/crates.io-index" 5906 5906 + checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0" 5907 5907 + dependencies = [ 5908 5908 + "windows-targets 0.42.2", 5909 5909 + ] 5910 5910 + 5911 5911 + [[package]] 5912 5912 + name = "windows-sys" 4963 5913 version = "0.48.0" 4964 5914 source = "registry+https://github.com/rust-lang/crates.io-index" 4965 5915 checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9" ··· 5005 5955 5006 5956 [[package]] 5007 5957 name = "windows-targets" 5958 5958 + version = "0.42.2" 5959 5959 + source = "registry+https://github.com/rust-lang/crates.io-index" 5960 5960 + checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071" 5961 5961 + dependencies = [ 5962 5962 + "windows_aarch64_gnullvm 0.42.2", 5963 5963 + "windows_aarch64_msvc 0.42.2", 5964 5964 + "windows_i686_gnu 0.42.2", 5965 5965 + "windows_i686_msvc 0.42.2", 5966 5966 + "windows_x86_64_gnu 0.42.2", 5967 5967 + "windows_x86_64_gnullvm 0.42.2", 5968 5968 + "windows_x86_64_msvc 0.42.2", 5969 5969 + ] 5970 5970 + 5971 5971 + [[package]] 5972 5972 + name = "windows-targets" 5008 5973 version = "0.48.5" 5009 5974 source = "registry+https://github.com/rust-lang/crates.io-index" 5010 5975 checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c" ··· 5053 6018 5054 6019 [[package]] 5055 6020 name = "windows_aarch64_gnullvm" 6021 6021 + version = "0.42.2" 6022 6022 + source = "registry+https://github.com/rust-lang/crates.io-index" 6023 6023 + checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8" 6024 6024 + 6025 6025 + [[package]] 6026 6026 + name = "windows_aarch64_gnullvm" 5056 6027 version = "0.48.5" 5057 6028 source = "registry+https://github.com/rust-lang/crates.io-index" 5058 6029 checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8" ··· 5071 6042 5072 6043 [[package]] 5073 6044 name = "windows_aarch64_msvc" 6045 6045 + version = "0.42.2" 6046 6046 + source = "registry+https://github.com/rust-lang/crates.io-index" 6047 6047 + checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43" 6048 6048 + 6049 6049 + [[package]] 6050 6050 + name = "windows_aarch64_msvc" 5074 6051 version = "0.48.5" 5075 6052 source = "registry+https://github.com/rust-lang/crates.io-index" 5076 6053 checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc" ··· 5089 6066 5090 6067 [[package]] 5091 6068 name = "windows_i686_gnu" 6069 6069 + version = "0.42.2" 6070 6070 + source = "registry+https://github.com/rust-lang/crates.io-index" 6071 6071 + checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f" 6072 6072 + 6073 6073 + [[package]] 6074 6074 + name = "windows_i686_gnu" 5092 6075 version = "0.48.5" 5093 6076 source = "registry+https://github.com/rust-lang/crates.io-index" 5094 6077 checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e" ··· 5119 6102 5120 6103 [[package]] 5121 6104 name = "windows_i686_msvc" 6105 6105 + version = "0.42.2" 6106 6106 + source = "registry+https://github.com/rust-lang/crates.io-index" 6107 6107 + checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060" 6108 6108 + 6109 6109 + [[package]] 6110 6110 + name = "windows_i686_msvc" 5122 6111 version = "0.48.5" 5123 6112 source = "registry+https://github.com/rust-lang/crates.io-index" 5124 6113 checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406" ··· 5137 6126 5138 6127 [[package]] 5139 6128 name = "windows_x86_64_gnu" 6129 6129 + version = "0.42.2" 6130 6130 + source = "registry+https://github.com/rust-lang/crates.io-index" 6131 6131 + checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36" 6132 6132 + 6133 6133 + [[package]] 6134 6134 + name = "windows_x86_64_gnu" 5140 6135 version = "0.48.5" 5141 6136 source = "registry+https://github.com/rust-lang/crates.io-index" 5142 6137 checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e" ··· 5155 6150 5156 6151 [[package]] 5157 6152 name = "windows_x86_64_gnullvm" 6153 6153 + version = "0.42.2" 6154 6154 + source = "registry+https://github.com/rust-lang/crates.io-index" 6155 6155 + checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3" 6156 6156 + 6157 6157 + [[package]] 6158 6158 + name = "windows_x86_64_gnullvm" 5158 6159 version = "0.48.5" 5159 6160 source = "registry+https://github.com/rust-lang/crates.io-index" 5160 6161 checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc" ··· 5173 6174 5174 6175 [[package]] 5175 6176 name = "windows_x86_64_msvc" 6177 6177 + version = "0.42.2" 6178 6178 + source = "registry+https://github.com/rust-lang/crates.io-index" 6179 6179 + checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0" 6180 6180 + 6181 6181 + [[package]] 6182 6182 + name = "windows_x86_64_msvc" 5176 6183 version = "0.48.5" 5177 6184 source = "registry+https://github.com/rust-lang/crates.io-index" 5178 6185 checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538" ··· 5190 6197 checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650" 5191 6198 5192 6199 [[package]] 6200 6200 + name = "winreg" 6201 6201 + version = "0.50.0" 6202 6202 + source = "registry+https://github.com/rust-lang/crates.io-index" 6203 6203 + checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1" 6204 6204 + dependencies = [ 6205 6205 + "cfg-if", 6206 6206 + "windows-sys 0.48.0", 6207 6207 + ] 6208 6208 + 6209 6209 + [[package]] 5193 6210 name = "wit-bindgen" 5194 6211 version = "0.46.0" 5195 6212 source = "registry+https://github.com/rust-lang/crates.io-index" 5196 6213 checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59" 5197 6214 5198 6215 [[package]] 6216 6216 + name = "wit-bindgen" 6217 6217 + version = "0.51.0" 6218 6218 + source = "registry+https://github.com/rust-lang/crates.io-index" 6219 6219 + checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5" 6220 6220 + dependencies = [ 6221 6221 + "wit-bindgen-rust-macro", 6222 6222 + ] 6223 6223 + 6224 6224 + [[package]] 6225 6225 + name = "wit-bindgen-core" 6226 6226 + version = "0.51.0" 6227 6227 + source = "registry+https://github.com/rust-lang/crates.io-index" 6228 6228 + checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc" 6229 6229 + dependencies = [ 6230 6230 + "anyhow", 6231 6231 + "heck 0.5.0", 6232 6232 + "wit-parser", 6233 6233 + ] 6234 6234 + 6235 6235 + [[package]] 6236 6236 + name = "wit-bindgen-rust" 6237 6237 + version = "0.51.0" 6238 6238 + source = "registry+https://github.com/rust-lang/crates.io-index" 6239 6239 + checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21" 6240 6240 + dependencies = [ 6241 6241 + "anyhow", 6242 6242 + "heck 0.5.0", 6243 6243 + "indexmap 2.12.1", 6244 6244 + "prettyplease", 6245 6245 + "syn 2.0.112", 6246 6246 + "wasm-metadata", 6247 6247 + "wit-bindgen-core", 6248 6248 + "wit-component", 6249 6249 + ] 6250 6250 + 6251 6251 + [[package]] 6252 6252 + name = "wit-bindgen-rust-macro" 6253 6253 + version = "0.51.0" 6254 6254 + source = "registry+https://github.com/rust-lang/crates.io-index" 6255 6255 + checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a" 6256 6256 + dependencies = [ 6257 6257 + "anyhow", 6258 6258 + "prettyplease", 6259 6259 + "proc-macro2", 6260 6260 + "quote", 6261 6261 + "syn 2.0.112", 6262 6262 + "wit-bindgen-core", 6263 6263 + "wit-bindgen-rust", 6264 6264 + ] 6265 6265 + 6266 6266 + [[package]] 6267 6267 + name = "wit-component" 6268 6268 + version = "0.244.0" 6269 6269 + source = "registry+https://github.com/rust-lang/crates.io-index" 6270 6270 + checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2" 6271 6271 + dependencies = [ 6272 6272 + "anyhow", 6273 6273 + "bitflags", 6274 6274 + "indexmap 2.12.1", 6275 6275 + "log", 6276 6276 + "serde", 6277 6277 + "serde_derive", 6278 6278 + "serde_json", 6279 6279 + "wasm-encoder", 6280 6280 + "wasm-metadata", 6281 6281 + "wasmparser", 6282 6282 + "wit-parser", 6283 6283 + ] 6284 6284 + 6285 6285 + [[package]] 6286 6286 + name = "wit-parser" 6287 6287 + version = "0.244.0" 6288 6288 + source = "registry+https://github.com/rust-lang/crates.io-index" 6289 6289 + checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736" 6290 6290 + dependencies = [ 6291 6291 + "anyhow", 6292 6292 + "id-arena", 6293 6293 + "indexmap 2.12.1", 6294 6294 + "log", 6295 6295 + "semver", 6296 6296 + "serde", 6297 6297 + "serde_derive", 6298 6298 + "serde_json", 6299 6299 + "unicode-xid", 6300 6300 + "wasmparser", 6301 6301 + ] 6302 6302 + 6303 6303 + [[package]] 5199 6304 name = "writeable" 5200 6305 version = "0.6.2" 5201 6306 source = "registry+https://github.com/rust-lang/crates.io-index" 5202 6307 checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9" 6308 6308 + 6309 6309 + [[package]] 6310 6310 + name = "xml5ever" 6311 6311 + version = "0.18.1" 6312 6312 + source = "registry+https://github.com/rust-lang/crates.io-index" 6313 6313 + checksum = "9bbb26405d8e919bc1547a5aa9abc95cbfa438f04844f5fdd9dc7596b748bf69" 6314 6314 + dependencies = [ 6315 6315 + "log", 6316 6316 + "mac", 6317 6317 + "markup5ever", 6318 6318 + ] 5203 6319 5204 6320 [[package]] 5205 6321 name = "yansi" ··· 5277 6393 source = "registry+https://github.com/rust-lang/crates.io-index" 5278 6394 checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0" 5279 6395 dependencies = [ 6396 6396 + "serde", 5280 6397 "zeroize_derive", 5281 6398 ] 5282 6399

+10 -1

Cargo.toml

··· 30 30 anyhow = "1.0.100" 31 31 chrono = { version = "0.4.42", features = ["default", "serde"] } 32 32 sha2 = "0.10" 33 33 + jacquard-api = { version = "0.9.5", features = ["com_atproto"] } 33 34 jacquard-common = "0.9.5" 34 35 jacquard-identity = "0.9.5" 35 36 multibase = "0.9.2" ··· 40 41 josekit = "0.10.3" 41 42 dashmap = "6.1" 42 43 tower = "0.5" 43 43 - valuable = "0.1.1" 44 44 + serde_yaml = "0.9" 45 45 + jacquard-oauth = "0.9.6" 46 46 + axum-extra = { version = "0.10", features = ["cookie-signed"] } 47 47 + uuid = { version = "1", features = ["v4"] } 48 48 + p256 = { version = "0.13", features = ["ecdsa", "jwk"] } 49 49 + jose-jwk = { version = "0.1", features = ["p256"] } 50 50 + base64 = "0.22" 51 51 + jacquard = "0.9.5" 52 52 +

+67

examples/admin_rbac.yaml

··· 1 1 + # PDS Admin Team — Role-Based Access Control 2 2 + # 3 3 + # This file defines which ATProto identities can perform admin operations 4 4 + # through pds-gatekeeper's admin portal. Each member authenticates via 5 5 + # ATProto OAuth (using their Bluesky/AT Protocol identity) and is granted 6 6 + # access only to the endpoints their roles permit. 7 7 + # 8 8 + # Endpoint patterns: 9 9 + # - Exact match: "com.atproto.admin.getAccountInfo" 10 10 + # - Wildcard: "com.atproto.admin.*" (matches all admin endpoints) 11 11 + # 12 12 + # Usage: 13 13 + # 1. Copy this file and customize for your team 14 14 + # 2. Set GATEKEEPER_ADMIN_RBAC_CONFIG=/path/to/your/admin_rbac.yaml 15 15 + # 3. Set PDS_ADMIN_PASSWORD=your-pds-admin-password 16 16 + # 4. Restart pds-gatekeeper 17 17 + # 5. Navigate to https://your-pds.example.com/admin/login 18 18 + 19 19 + roles: 20 20 + pds-admin: 21 21 + description: "Full PDS administrator — all admin endpoints + account/invite creation" 22 22 + endpoints: 23 23 + - "com.atproto.admin.*" 24 24 + - "com.atproto.server.createInviteCode" 25 25 + - "com.atproto.server.createInviteCodes" 26 26 + - "com.atproto.server.createAccount" 27 27 + - "com.atproto.sync.requestCrawl" 28 28 + 29 29 + moderator: 30 30 + description: "Content moderation — view accounts, manage takedowns and subject status" 31 31 + endpoints: 32 32 + - "com.atproto.admin.getAccountInfo" 33 33 + - "com.atproto.admin.getAccountInfos" 34 34 + - "com.atproto.admin.getSubjectStatus" 35 35 + - "com.atproto.admin.updateSubjectStatus" 36 36 + - "com.atproto.admin.sendEmail" 37 37 + - "com.atproto.admin.getInviteCodes" 38 38 + 39 39 + invite-manager: 40 40 + description: "Invite code management — create and manage invite codes" 41 41 + endpoints: 42 42 + - "com.atproto.admin.getInviteCodes" 43 43 + - "com.atproto.admin.disableInviteCodes" 44 44 + - "com.atproto.admin.enableAccountInvites" 45 45 + - "com.atproto.admin.disableAccountInvites" 46 46 + - "com.atproto.server.createInviteCode" 47 47 + - "com.atproto.server.createInviteCodes" 48 48 + 49 49 + members: 50 50 + # Replace these with your team members' DIDs. 51 51 + # Resolve a handle to its DID with: goat resolve {handle} 52 52 + 53 53 + # Example: Full admin 54 54 + - did: "did:plc:your-admin-did-here" 55 55 + roles: 56 56 + - pds-admin 57 57 + 58 58 + # Example: Moderator only 59 59 + - did: "did:plc:your-moderator-did-here" 60 60 + roles: 61 61 + - moderator 62 62 + 63 63 + # Example: Someone with both moderator and invite manager roles 64 64 + - did: "did:plc:your-team-member-did-here" 65 65 + roles: 66 66 + - moderator 67 67 + - invite-manager

+223

html_templates/admin/account_detail.hbs

··· 1 1 + <!DOCTYPE html> 2 2 + <html lang="en"> 3 3 + <head> 4 4 + <meta charset="utf-8"/> 5 5 + <meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, viewport-fit=cover"/> 6 6 + <meta name="referrer" content="origin-when-cross-origin"/> 7 7 + <title>{{account.handle}} - {{pds_hostname}}</title> 8 8 + <link rel="stylesheet" href="/admin/static/css/admin.css"> 9 9 + </head> 10 10 + <body> 11 11 + <div class="layout"> 12 12 + {{> admin/partials/sidebar.hbs}} 13 13 + 14 14 + <main class="main"> 15 15 + {{> admin/partials/flash.hbs}} 16 16 + 17 17 + <a href="/admin/accounts" class="back-link">&larr; Back to Accounts</a> 18 18 + 19 19 + <h1 class="page-title">{{account.handle}}</h1> 20 20 + <div class="page-subtitle">{{account.did}}</div> 21 21 + 22 22 + {{#if new_password}} 23 23 + <div class="password-box"> 24 24 + <div class="pw-label">New Password (copy now -- it will not be shown again)</div> 25 25 + <div class="pw-value">{{new_password}}</div> 26 26 + </div> 27 27 + {{/if}} 28 28 + 29 29 + <div class="detail-section"> 30 30 + <h3>Account Information</h3> 31 31 + <div class="detail-row"> 32 32 + <span class="label">Handle</span> 33 33 + <span class="value">{{account.handle}}</span> 34 34 + </div> 35 35 + <div class="detail-row"> 36 36 + <span class="label">DID</span> 37 37 + <span class="value">{{account.did}}</span> 38 38 + </div> 39 39 + <div class="detail-row"> 40 40 + <span class="label">Email</span> 41 41 + <span class="value">{{account.email}}</span> 42 42 + </div> 43 43 + {{#if account.indexedAt}} 44 44 + <div class="detail-row"> 45 45 + <span class="label">Indexed At</span> 46 46 + <span class="value">{{account.indexedAt}}</span> 47 47 + </div> 48 48 + {{/if}} 49 49 + {{#if handle_resolution_checked}} 50 50 + <div class="detail-row"> 51 51 + <span class="label">Handle Resolution</span> 52 52 + <span class="value"> 53 53 + {{#if handle_is_correct}} 54 54 + <span class="badge badge-success">Valid</span> 55 55 + {{else}} 56 56 + <span class="badge badge-danger">Failed</span> 57 57 + {{/if}} 58 58 + </span> 59 59 + </div> 60 60 + {{/if}} 61 61 + </div> 62 62 + 63 63 + <div class="detail-section"> 64 64 + <h3>Status</h3> 65 65 + <div class="detail-row"> 66 66 + <span class="label">Takedown</span> 67 67 + <span class="value"> 68 68 + {{#if is_taken_down}} 69 69 + <span class="badge badge-danger">Taken Down</span> 70 70 + {{else}} 71 71 + <span class="badge badge-success">Active</span> 72 72 + {{/if}} 73 73 + </span> 74 74 + </div> 75 75 + {{#if takedown_ref}} 76 76 + <div class="detail-row"> 77 77 + <span class="label">Takedown Reference</span> 78 78 + <span class="value">{{takedown_ref}}</span> 79 79 + </div> 80 80 + {{/if}} 81 81 + <div class="detail-row"> 82 82 + <span class="label">Email Confirmed</span> 83 83 + <span class="value"> 84 84 + {{#if account.emailConfirmedAt}} 85 85 + <span class="badge badge-success">Confirmed</span> 86 86 + {{else}} 87 87 + <span class="badge badge-warning">Unconfirmed</span> 88 88 + {{/if}} 89 89 + </span> 90 90 + </div> 91 91 + <div class="detail-row"> 92 92 + <span class="label">Deactivated</span> 93 93 + <span class="value"> 94 94 + {{#if account.deactivatedAt}} 95 95 + <span class="badge badge-warning">{{account.deactivatedAt}}</span> 96 96 + {{else}} 97 97 + <span class="badge badge-success">No</span> 98 98 + {{/if}} 99 99 + </span> 100 100 + </div> 101 101 + </div> 102 102 + 103 103 + {{#if repo_status_checked}} 104 104 + <div class="detail-section"> 105 105 + <h3>Repo Status</h3> 106 106 + <div class="detail-row"> 107 107 + <span class="label">Active</span> 108 108 + <span class="value"> 109 109 + {{#if repo_active}} 110 110 + <span class="badge badge-success">Active</span> 111 111 + {{else}} 112 112 + <span class="badge badge-danger">Inactive</span> 113 113 + {{/if}} 114 114 + </span> 115 115 + </div> 116 116 + {{#if repo_status_reason}} 117 117 + <div class="detail-row"> 118 118 + <span class="label">Status Reason</span> 119 119 + <span class="value">{{repo_status_reason}}</span> 120 120 + </div> 121 121 + {{/if}} 122 122 + {{#if repo_rev}} 123 123 + <div class="detail-row"> 124 124 + <span class="label">Revision</span> 125 125 + <span class="value mono-text">{{repo_rev}}</span> 126 126 + </div> 127 127 + {{/if}} 128 128 + </div> 129 129 + {{/if}} 130 130 + 131 131 + <div class="detail-section"> 132 132 + <h3>Invite Information</h3> 133 133 + {{#if account.invitedBy}} 134 134 + <div class="detail-row"> 135 135 + <span class="label">Invited By</span> 136 136 + <span class="value">{{account.invitedBy}}</span> 137 137 + </div> 138 138 + {{/if}} 139 139 + <div class="detail-row"> 140 140 + <span class="label">Invites Disabled</span> 141 141 + <span class="value"> 142 142 + {{#if account.invitesDisabled}} 143 143 + <span class="badge badge-danger">Yes</span> 144 144 + {{else}} 145 145 + <span class="badge badge-success">No</span> 146 146 + {{/if}} 147 147 + </span> 148 148 + </div> 149 149 + {{#if account.inviteNote}} 150 150 + <div class="detail-row"> 151 151 + <span class="label">Invite Note</span> 152 152 + <span class="value">{{account.inviteNote}}</span> 153 153 + </div> 154 154 + {{/if}} 155 155 + </div> 156 156 + 157 157 + {{#if collections}} 158 158 + <div class="detail-section"> 159 159 + <h3>Collections</h3> 160 160 + <div class="collection-list"> 161 161 + {{#each collections}} 162 162 + <div class="collection-item">{{this}}</div> 163 163 + {{/each}} 164 164 + </div> 165 165 + </div> 166 166 + {{/if}} 167 167 + 168 168 + {{#if threat_signatures}} 169 169 + <div class="detail-section"> 170 170 + <h3>Threat Signatures</h3> 171 171 + {{#each threat_signatures}} 172 172 + <div class="threat-sig">{{this.property}}: {{this.value}}</div> 173 173 + {{/each}} 174 174 + </div> 175 175 + {{/if}} 176 176 + 177 177 + <div class="detail-section"> 178 178 + <h3>Actions</h3> 179 179 + <div class="actions"> 180 180 + {{#if can_manage_takedowns}} 181 181 + {{#if is_taken_down}} 182 182 + <form method="POST" action="/admin/accounts/{{account.did}}/untakedown"> 183 183 + <button type="submit" class="btn btn-primary">Remove Takedown</button> 184 184 + </form> 185 185 + {{else}} 186 186 + <form method="POST" action="/admin/accounts/{{account.did}}/takedown"> 187 187 + <button type="submit" class="btn btn-warning">Takedown Account</button> 188 188 + </form> 189 189 + {{/if}} 190 190 + {{/if}} 191 191 + 192 192 + {{#if can_reset_password}} 193 193 + <form method="POST" action="/admin/accounts/{{account.did}}/reset-password" 194 194 + onsubmit="return confirm('Are you sure you want to reset this account password? The current password will be invalidated.');"> 195 195 + <button type="submit" class="btn">Reset Password</button> 196 196 + </form> 197 197 + {{/if}} 198 198 + 199 199 + {{#if can_manage_invites}} 200 200 + {{#if account.invitesDisabled}} 201 201 + <form method="POST" action="/admin/accounts/{{account.did}}/enable-invites"> 202 202 + <button type="submit" class="btn">Enable Invites</button> 203 203 + </form> 204 204 + {{else}} 205 205 + <form method="POST" action="/admin/accounts/{{account.did}}/disable-invites"> 206 206 + <button type="submit" class="btn">Disable Invites</button> 207 207 + </form> 208 208 + {{/if}} 209 209 + {{/if}} 210 210 + 211 211 + {{#if can_delete_account}} 212 212 + <form method="POST" action="/admin/accounts/{{account.did}}/delete" 213 213 + onsubmit="return confirm('PERMANENTLY DELETE this account? This action cannot be undone.');"> 214 214 + <button type="submit" class="btn btn-danger">Delete Account</button> 215 215 + </form> 216 216 + {{/if}} 217 217 + </div> 218 218 + </div> 219 219 + </main> 220 220 + </div> 221 221 + 222 222 + </body> 223 223 + </html>

+78

html_templates/admin/accounts.hbs

··· 1 1 + <!DOCTYPE html> 2 2 + <html lang="en"> 3 3 + <head> 4 4 + <meta charset="utf-8"/> 5 5 + <meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, viewport-fit=cover"/> 6 6 + <meta name="referrer" content="origin-when-cross-origin"/> 7 7 + <title>Accounts - {{pds_hostname}}</title> 8 8 + <link rel="stylesheet" href="/admin/static/css/admin.css"> 9 9 + </head> 10 10 + <body> 11 11 + <div class="layout"> 12 12 + {{> admin/partials/sidebar.hbs}} 13 13 + 14 14 + <main class="main"> 15 15 + {{> admin/partials/flash.hbs}} 16 16 + 17 17 + <h1 class="page-title">Accounts</h1> 18 18 + 19 19 + <form class="search-form" method="GET" action="/admin/accounts/lookup"> 20 20 + <input type="text" name="direct_lookup" placeholder="Direct lookup by did or handle"/> 21 21 + <button type="submit" class="btn btn-primary">Lookup</button> 22 22 + </form> 23 23 + 24 24 + 25 25 + {{#if accounts}} 26 26 + <div class="table-container"> 27 27 + <table> 28 28 + <thead> 29 29 + <tr> 30 30 + <th>Handle</th> 31 31 + <th>DID</th> 32 32 + <th>Email</th> 33 33 + <th>Status</th> 34 34 + </tr> 35 35 + </thead> 36 36 + <tbody> 37 37 + {{#each accounts}} 38 38 + <tr> 39 39 + <td><a href="/admin/accounts/{{this.did}}">{{this.handle}}</a></td> 40 40 + <td class="did-cell">{{this.did}}</td> 41 41 + <td>{{this.email}}</td> 42 42 + <td> 43 43 + {{#if (or this.is_taken_down (eq this.status "takedown"))}} 44 44 + <span class="badge badge-danger">Taken Down</span> 45 45 + {{/if}} 46 46 + {{#if (or this.deactivatedAt (eq this.status "deactivated"))}} 47 47 + <span class="badge badge-warning">Deactivated</span> 48 48 + {{/if}} 49 49 + {{#if (and (not this.is_taken_down) (not (eq this.status "takedown")) (not this.deactivatedAt) (not (eq this.status "deactivated")))}} 50 50 + <span class="badge badge-success">Active</span> 51 51 + {{/if}} 52 52 + </td> 53 53 + </tr> 54 54 + {{/each}} 55 55 + </tbody> 56 56 + </table> 57 57 + </div> 58 58 + 59 59 + {{#if (or has_prev has_next)}} 60 60 + <div class="pagination"> 61 61 + {{#if has_prev}} 62 62 + <a href="{{prev_url}}" class="btn btn-small">&larr; Previous</a> 63 63 + {{/if}} 64 64 + <span class="pagination-info">Showing {{account_count}} accounts</span> 65 65 + {{#if has_next}} 66 66 + <a href="{{next_url}}" class="btn btn-small">Next &rarr;</a> 67 67 + {{/if}} 68 68 + </div> 69 69 + {{/if}} 70 70 + {{else}} 71 71 + <div class="empty-state"> 72 72 + No accounts found 73 73 + </div> 74 74 + {{/if}} 75 75 + </main> 76 76 + </div> 77 77 + </body> 78 78 + </html>

+101

html_templates/admin/create_account.hbs

··· 1 1 + <!DOCTYPE html> 2 2 + <html lang="en"> 3 3 + <head> 4 4 + <meta charset="utf-8"/> 5 5 + <meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, viewport-fit=cover"/> 6 6 + <meta name="referrer" content="origin-when-cross-origin"/> 7 7 + <title>Create Account - {{pds_hostname}}</title> 8 8 + <link rel="stylesheet" href="/admin/static/css/admin.css"> 9 9 + </head> 10 10 + <body> 11 11 + <div class="layout"> 12 12 + {{> admin/partials/sidebar.hbs}} 13 13 + 14 14 + <main class="main"> 15 15 + {{> admin/partials/flash.hbs}} 16 16 + 17 17 + <h1 class="page-title">Create Account</h1> 18 18 + 19 19 + {{#if created}} 20 20 + <div class="success-card"> 21 21 + <h3>Account Created Successfully</h3> 22 22 + <div class="detail-row"> 23 23 + <span class="label">DID</span> 24 24 + <span class="value">{{created.did}} 25 25 + <button class="copy-btn" onclick="copyToClipboard('{{created.did}}', this)">Copy</button></span> 26 26 + </div> 27 27 + <div class="detail-row"> 28 28 + <span class="label">Handle</span> 29 29 + <span class="value">{{created.handle}} 30 30 + <button class="copy-btn" 31 31 + onclick="copyToClipboard('{{created.handle}}', this)">Copy</button></span> 32 32 + </div> 33 33 + <div class="detail-row"> 34 34 + <span class="label">Email</span> 35 35 + <span class="value">{{created.email}} 36 36 + <button class="copy-btn" 37 37 + onclick="copyToClipboard('{{created.email}}', this)">Copy</button></span> 38 38 + </div> 39 39 + <div class="detail-row"> 40 40 + <span class="label">Password</span> 41 41 + <span class="value"><span class="password-highlight">{{created.password}}</span> <button 42 42 + class="copy-btn" 43 43 + onclick="copyToClipboard('{{created.password}}', this)">Copy</button></span> 44 44 + </div> 45 45 + {{#if created.inviteCode}} 46 46 + <div class="detail-row"> 47 47 + <span class="label">Invite Code Used</span> 48 48 + <span class="value">{{created.inviteCode}} 49 49 + <button class="copy-btn" 50 50 + onclick="copyToClipboard('{{created.inviteCode}}', this)">Copy</button></span> 51 51 + </div> 52 52 + {{/if}} 53 53 + </div> 54 54 + {{else}} 55 55 + <div class="form-card"> 56 56 + <form method="POST" action="/admin/create-account"> 57 57 + <div class="form-group"> 58 58 + <label for="email">Email</label> 59 59 + <input type="email" id="email" name="email" placeholder="user@example.com" required/> 60 60 + </div> 61 61 + <div class="form-group"> 62 62 + <label for="handle">Handle</label> 63 63 + <input type="text" id="handle" name="handle" placeholder="user.example.com" required/> 64 64 + <div class="hint">Must be a valid handle for this PDS</div> 65 65 + </div> 66 66 + <button type="submit" class="btn btn-primary">Create Account</button> 67 67 + </form> 68 68 + </div> 69 69 + {{/if}} 70 70 + </main> 71 71 + </div> 72 72 + 73 73 + <script> 74 74 + function copyToClipboard(text, btn) { 75 75 + if (navigator.clipboard && navigator.clipboard.writeText) { 76 76 + navigator.clipboard.writeText(text).then(function () { 77 77 + var orig = btn.textContent; 78 78 + btn.textContent = 'Copied'; 79 79 + setTimeout(function () { 80 80 + btn.textContent = orig; 81 81 + }, 1500); 82 82 + }); 83 83 + } else { 84 84 + var el = document.createElement('textarea'); 85 85 + el.value = text; 86 86 + el.style.position = 'fixed'; 87 87 + el.style.opacity = '0'; 88 88 + document.body.appendChild(el); 89 89 + el.select(); 90 90 + document.execCommand('copy'); 91 91 + document.body.removeChild(el); 92 92 + var orig = btn.textContent; 93 93 + btn.textContent = 'Copied'; 94 94 + setTimeout(function () { 95 95 + btn.textContent = orig; 96 96 + }, 1500); 97 97 + } 98 98 + } 99 99 + </script> 100 100 + </body> 101 101 + </html>

+91

html_templates/admin/dashboard.hbs

··· 1 1 + <!DOCTYPE html> 2 2 + <html lang="en"> 3 3 + <head> 4 4 + <meta charset="utf-8"/> 5 5 + <meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, viewport-fit=cover"/> 6 6 + <meta name="referrer" content="origin-when-cross-origin"/> 7 7 + <title>Dashboard - {{pds_hostname}}</title> 8 8 + <link rel="stylesheet" href="/admin/static/css/admin.css"> 9 9 + </head> 10 10 + <body> 11 11 + <div class="layout"> 12 12 + {{> admin/partials/sidebar.hbs}} 13 13 + 14 14 + <main class="main"> 15 15 + {{> admin/partials/flash.hbs}} 16 16 + 17 17 + <h1 class="page-title">Dashboard</h1> 18 18 + 19 19 + <div class="cards"> 20 20 + <div class="card"> 21 21 + <div class="card-label">PDS Version</div> 22 22 + <div class="card-value">{{version}}</div> 23 23 + </div> 24 24 + {{#if can_view_accounts}} 25 25 + <div class="card"> 26 26 + <div class="card-label">Total Accounts</div> 27 27 + <div class="card-value">{{account_count}}</div> 28 28 + </div> 29 29 + {{/if}} 30 30 + <div class="card"> 31 31 + <div class="card-label">Invite Code Required</div> 32 32 + <div class="card-value">{{#if invite_code_required}}Yes{{else}}No{{/if}}</div> 33 33 + </div> 34 34 + <div class="card"> 35 35 + <div class="card-label">Phone Verification</div> 36 36 + <div class="card-value">{{#if phone_verification_required}}Required{{else}}Not Required{{/if}}</div> 37 37 + </div> 38 38 + </div> 39 39 + 40 40 + <div class="detail-section"> 41 41 + <h3>Server Information</h3> 42 42 + <div class="detail-row"> 43 43 + <span class="label">Server DID</span> 44 44 + <span class="value">{{server_did}}</span> 45 45 + </div> 46 46 + <div class="detail-row"> 47 47 + <span class="label">Available Domains</span> 48 48 + <span class="value">{{available_domains}}</span> 49 49 + </div> 50 50 + {{#if contact_email}} 51 51 + <div class="detail-row"> 52 52 + <span class="label">Contact Email</span> 53 53 + <span class="value">{{contact_email}}</span> 54 54 + </div> 55 55 + {{/if}} 56 56 + </div> 57 57 + 58 58 + {{#if privacy_policy}} 59 59 + <div class="detail-section"> 60 60 + <h3>Server Links</h3> 61 61 + {{#if terms_of_service}} 62 62 + <div class="detail-row"> 63 63 + <span class="label">Terms of Service</span> 64 64 + <span class="value"><a href="{{terms_of_service}}" target="_blank" 65 65 + rel="noopener">{{terms_of_service}}</a></span> 66 66 + </div> 67 67 + {{/if}} 68 68 + {{#if privacy_policy}} 69 69 + <div class="detail-row"> 70 70 + <span class="label">Privacy Policy</span> 71 71 + <span class="value"><a href="{{privacy_policy}}" target="_blank" 72 72 + rel="noopener">{{privacy_policy}}</a></span> 73 73 + </div> 74 74 + {{/if}} 75 75 + </div> 76 76 + {{else}} 77 77 + {{#if terms_of_service}} 78 78 + <div class="detail-section"> 79 79 + <h3>Server Links</h3> 80 80 + <div class="detail-row"> 81 81 + <span class="label">Terms of Service</span> 82 82 + <span class="value"><a href="{{terms_of_service}}" target="_blank" 83 83 + rel="noopener">{{terms_of_service}}</a></span> 84 84 + </div> 85 85 + </div> 86 86 + {{/if}} 87 87 + {{/if}} 88 88 + </main> 89 89 + </div> 90 90 + </body> 91 91 + </html>

+37

html_templates/admin/error.hbs

··· 1 1 + <!DOCTYPE html> 2 2 + <html lang="en"> 3 3 + <head> 4 4 + <meta charset="utf-8"/> 5 5 + <meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, viewport-fit=cover"/> 6 6 + <meta name="referrer" content="origin-when-cross-origin"/> 7 7 + <title>Error - {{pds_hostname}}</title> 8 8 + <link rel="stylesheet" href="/admin/static/css/admin.css"> 9 9 + </head> 10 10 + <body> 11 11 + {{#if handle}} 12 12 + {{!-- Logged-in user: show sidebar layout --}} 13 13 + <div class="layout"> 14 14 + {{> admin/partials/sidebar.hbs}} 15 15 + 16 16 + <main class="main"> 17 17 + <div class="error-card error-card--inset"> 18 18 + <div class="error-icon">!</div> 19 19 + <div class="error-title">{{error_title}}</div> 20 20 + <div class="error-message">{{error_message}}</div> 21 21 + <a href="/admin/dashboard" class="error-link">Back to Dashboard</a> 22 22 + </div> 23 23 + </main> 24 24 + </div> 25 25 + {{else}} 26 26 + {{!-- Not logged in: standalone centered layout --}} 27 27 + <div class="centered"> 28 28 + <div class="error-card"> 29 29 + <div class="error-icon">!</div> 30 30 + <div class="error-title">{{error_title}}</div> 31 31 + <div class="error-message">{{error_message}}</div> 32 32 + <a href="/admin/login" class="error-link">Go to Login</a> 33 33 + </div> 34 34 + </div> 35 35 + {{/if}} 36 36 + </body> 37 37 + </html>

+93

html_templates/admin/invite_codes.hbs

··· 1 1 + <!DOCTYPE html> 2 2 + <html lang="en"> 3 3 + <head> 4 4 + <meta charset="utf-8"/> 5 5 + <meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, viewport-fit=cover"/> 6 6 + <meta name="referrer" content="origin-when-cross-origin"/> 7 7 + <title>Invite Codes - {{pds_hostname}}</title> 8 8 + <link rel="stylesheet" href="/admin/static/css/admin.css"> 9 9 + </head> 10 10 + <body> 11 11 + <div class="layout"> 12 12 + {{> admin/partials/sidebar.hbs}} 13 13 + 14 14 + <main class="main"> 15 15 + {{> admin/partials/flash.hbs}} 16 16 + 17 17 + <h1 class="page-title">Invite Codes</h1> 18 18 + 19 19 + {{#if can_create_invite}} 20 20 + <form class="create-form" method="POST" action="/admin/invite-codes/create"> 21 21 + <div class="form-group"> 22 22 + <label for="use_count">Max Uses</label> 23 23 + <input type="number" id="use_count" name="use_count" value="1" min="1" max="100"/> 24 24 + </div> 25 25 + <button type="submit" class="btn btn-primary">Create Invite Code</button> 26 26 + </form> 27 27 + {{/if}} 28 28 + 29 29 + {{#if new_code}} 30 30 + <div class="code-box"> 31 31 + <div class="code-label">New Invite Code Created</div> 32 32 + <div class="code-value">{{new_code}}</div> 33 33 + </div> 34 34 + {{/if}} 35 35 + 36 36 + {{#if codes}} 37 37 + <div class="table-container"> 38 38 + <table> 39 39 + <thead> 40 40 + <tr> 41 41 + <th>Code</th> 42 42 + <th>Remaining / Total</th> 43 43 + <th>Status</th> 44 44 + <th>Created By</th> 45 45 + <th>Created At</th> 46 46 + {{#if can_manage_invites}} 47 47 + <th></th> 48 48 + {{/if}} 49 49 + </tr> 50 50 + </thead> 51 51 + <tbody> 52 52 + {{#each codes}} 53 53 + <tr> 54 54 + <td class="code-cell">{{this.code}}</td> 55 55 + <td>{{this.remaining}} / {{this.available}}</td> 56 56 + <td> 57 57 + {{#if this.disabled}} 58 58 + <span class="badge badge-danger">Disabled</span> 59 59 + {{else}} 60 60 + <span class="badge badge-success">Active</span> 61 61 + {{/if}} 62 62 + </td> 63 63 + <td>{{this.createdBy}}</td> 64 64 + <td>{{this.createdAt}}</td> 65 65 + {{#if ../can_manage_invites}} 66 66 + <td> 67 67 + {{#unless this.disabled}} 68 68 + <form method="POST" action="/admin/invite-codes/disable" 69 69 + class="inline-form"> 70 70 + <input type="hidden" name="codes" value="{{this.code}}"/> 71 71 + <button type="submit" class="btn btn-small btn-outline-danger">Disable 72 72 + </button> 73 73 + </form> 74 74 + {{/unless}} 75 75 + </td> 76 76 + {{/if}} 77 77 + </tr> 78 78 + {{/each}} 79 79 + </tbody> 80 80 + </table> 81 81 + </div> 82 82 + {{#if has_more}} 83 83 + <div class="load-more"> 84 84 + <a href="/admin/invite-codes?cursor={{next_cursor}}">Load More</a> 85 85 + </div> 86 86 + {{/if}} 87 87 + {{else}} 88 88 + <div class="empty-state">No invite codes found</div> 89 89 + {{/if}} 90 90 + </main> 91 91 + </div> 92 92 + </body> 93 93 + </html>

+36

html_templates/admin/login.hbs

··· 1 1 + <!DOCTYPE html> 2 2 + <html lang="en"> 3 3 + <head> 4 4 + <meta charset="utf-8"/> 5 5 + <meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, viewport-fit=cover"/> 6 6 + <meta name="referrer" content="origin-when-cross-origin"/> 7 7 + <title>Admin Login - {{pds_hostname}}</title> 8 8 + <link rel="stylesheet" href="/admin/static/css/admin.css"> 9 9 + <style> 10 10 + body { 11 11 + min-height: 100vh; 12 12 + display: flex; 13 13 + align-items: center; 14 14 + justify-content: center; 15 15 + } 16 16 + </style> 17 17 + </head> 18 18 + <body> 19 19 + <div class="login-card"> 20 20 + <div class="login-title">{{pds_hostname}}</div> 21 21 + <div class="login-subtitle">Admin Portal</div> 22 22 + 23 23 + {{#if error}} 24 24 + <div class="error-msg">{{error}}</div> 25 25 + {{/if}} 26 26 + 27 27 + <form method="POST" action="/admin/login"> 28 28 + <div class="form-group"> 29 29 + <label for="handle">Handle</label> 30 30 + <input type="text" id="handle" name="handle" placeholder="you.bsky.social" required autofocus /> 31 31 + </div> 32 32 + <button type="submit" class="btn btn-primary">Login with OAuth</button> 33 33 + </form> 34 34 + </div> 35 35 + </body> 36 36 + </html>

+6

html_templates/admin/partials/flash.hbs

··· 1 1 + {{#if flash_success}} 2 2 + <div class="flash-success">{{flash_success}}</div> 3 3 + {{/if}} 4 4 + {{#if flash_error}} 5 5 + <div class="flash-error">{{flash_error}}</div> 6 6 + {{/if}}

+38

html_templates/admin/partials/sidebar.hbs

··· 1 1 + <div class="topbar"> 2 2 + <button class="hamburger" id="hamburger" aria-label="Toggle menu"> 3 3 + <span></span> 4 4 + <span></span> 5 5 + <span></span> 6 6 + </button> 7 7 + <span class="topbar-title">{{pds_hostname}} — Admin</span> 8 8 + </div> 9 9 + 10 10 + <div class="sidebar-overlay" id="sidebar-overlay"></div> 11 11 + 12 12 + <aside class="sidebar"> 13 13 + <div class="sidebar-title">{{pds_hostname}}</div> 14 14 + <div class="sidebar-subtitle">Admin Portal</div> 15 15 + <nav> 16 16 + <a href="/admin/dashboard" {{#if (eq active_page "dashboard")}}class="active"{{/if}}>Dashboard</a> 17 17 + {{#if can_view_accounts}} 18 18 + <a href="/admin/accounts" {{#if (eq active_page "accounts")}}class="active"{{/if}}>Accounts</a> 19 19 + {{/if}} 20 20 + {{#if can_manage_invites}} 21 21 + <a href="/admin/invite-codes" {{#if (eq active_page "invite_codes")}}class="active"{{/if}}>Invite Codes</a> 22 22 + {{/if}} 23 23 + {{#if can_create_account}} 24 24 + <a href="/admin/create-account" {{#if (eq active_page "create_account")}}class="active"{{/if}}>Create Account</a> 25 25 + {{/if}} 26 26 + {{#if can_request_crawl}} 27 27 + <a href="/admin/request-crawl" {{#if (eq active_page "request_crawl")}}class="active"{{/if}}>Request Crawl</a> 28 28 + {{/if}} 29 29 + </nav> 30 30 + <div class="sidebar-footer"> 31 31 + <div class="session-info">Signed in as {{handle}}</div> 32 32 + <form method="POST" action="/admin/logout"> 33 33 + <button type="submit">Sign out</button> 34 34 + </form> 35 35 + </div> 36 36 + </aside> 37 37 + 38 38 + <script src="/admin/static/js/admin.js"></script>

+34

html_templates/admin/request_crawl.hbs

··· 1 1 + <!DOCTYPE html> 2 2 + <html lang="en"> 3 3 + <head> 4 4 + <meta charset="utf-8"/> 5 5 + <meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, viewport-fit=cover"/> 6 6 + <meta name="referrer" content="origin-when-cross-origin"/> 7 7 + <title>Request Crawl - {{pds_hostname}}</title> 8 8 + <link rel="stylesheet" href="/admin/static/css/admin.css"> 9 9 + </head> 10 10 + <body> 11 11 + <div class="layout"> 12 12 + {{> admin/partials/sidebar.hbs}} 13 13 + 14 14 + <main class="main"> 15 15 + {{> admin/partials/flash.hbs}} 16 16 + 17 17 + <h1 class="page-title">Request Crawl</h1> 18 18 + <p class="page-description">Request a relay to crawl this PDS. This sends your PDS hostname to the relay so it 19 19 + can discover and index your content.</p> 20 20 + 21 21 + <div class="form-card"> 22 22 + <form method="POST" action="/admin/request-crawl"> 23 23 + <div class="form-group"> 24 24 + <label for="relay_host">Relay Host</label> 25 25 + <input type="text" id="relay_host" name="relay_host" value="{{default_relay}}" required/> 26 26 + <div class="hint">The relay hostname to send the crawl request to (e.g., bsky.network)</div> 27 27 + </div> 28 28 + <button type="submit" class="btn btn-primary">Request Crawl</button> 29 29 + </form> 30 30 + </div> 31 31 + </main> 32 32 + </div> 33 33 + </body> 34 34 + </html>

+8

migrations/20260228000000_admin_sessions.sql

··· 1 1 + CREATE TABLE admin_sessions ( 2 2 + session_id VARCHAR(36) PRIMARY KEY, 3 3 + did VARCHAR NOT NULL, 4 4 + handle VARCHAR NOT NULL, 5 5 + created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP, 6 6 + expires_at TIMESTAMP NOT NULL 7 7 + ); 8 8 + CREATE INDEX idx_admin_sessions_expires_at ON admin_sessions(expires_at);

+18

migrations/20260303000000_oauth_auth_store.sql

··· 1 1 + -- OAuth client session storage (replaces in-memory MemoryAuthStore) 2 2 + CREATE TABLE IF NOT EXISTS oauth_client_sessions ( 3 3 + session_key VARCHAR NOT NULL PRIMARY KEY, 4 4 + did VARCHAR NOT NULL, 5 5 + session_id VARCHAR NOT NULL, 6 6 + data TEXT NOT NULL, 7 7 + created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP, 8 8 + updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP 9 9 + ); 10 10 + 11 11 + CREATE INDEX IF NOT EXISTS idx_oauth_client_sessions_did ON oauth_client_sessions(did); 12 12 + 13 13 + -- OAuth authorization request storage (transient, keyed by state token) 14 14 + CREATE TABLE IF NOT EXISTS oauth_auth_requests ( 15 15 + state VARCHAR NOT NULL PRIMARY KEY, 16 16 + data TEXT NOT NULL, 17 17 + created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP 18 18 + );

+109

src/admin/middleware.rs

··· 1 1 + use axum::{ 2 2 + extract::{Request, State}, 3 3 + http::StatusCode, 4 4 + middleware::Next, 5 5 + response::{IntoResponse, Redirect, Response}, 6 6 + }; 7 7 + use axum_extra::extract::cookie::SignedCookieJar; 8 8 + 9 9 + use crate::AppState; 10 10 + 11 11 + use super::rbac::RbacConfig; 12 12 + use super::session; 13 13 + 14 14 + /// Admin session data injected into request extensions. 15 15 + #[derive(Debug, Clone)] 16 16 + pub struct AdminSession { 17 17 + pub did: String, 18 18 + pub handle: String, 19 19 + pub roles: Vec<String>, 20 20 + } 21 21 + 22 22 + /// Pre-computed permission flags for template rendering and quick checks. 23 23 + #[derive(Debug, Clone)] 24 24 + pub struct AdminPermissions { 25 25 + pub can_view_accounts: bool, 26 26 + pub can_manage_takedowns: bool, 27 27 + pub can_delete_account: bool, 28 28 + pub can_reset_password: bool, 29 29 + pub can_create_account: bool, 30 30 + pub can_manage_invites: bool, 31 31 + pub can_create_invite: bool, 32 32 + pub can_send_email: bool, 33 33 + pub can_request_crawl: bool, 34 34 + } 35 35 + 36 36 + impl AdminPermissions { 37 37 + pub fn compute(rbac: &RbacConfig, did: &str) -> Self { 38 38 + Self { 39 39 + can_view_accounts: rbac 40 40 + .can_access_endpoint(did, "com.atproto.admin.getAccountInfo") 41 41 + || rbac.can_access_endpoint(did, "com.atproto.admin.getAccountInfos"), 42 42 + can_manage_takedowns: rbac 43 43 + .can_access_endpoint(did, "com.atproto.admin.updateSubjectStatus"), 44 44 + can_delete_account: rbac 45 45 + .can_access_endpoint(did, "com.atproto.admin.deleteAccount"), 46 46 + can_reset_password: rbac 47 47 + .can_access_endpoint(did, "com.atproto.admin.updateAccountPassword"), 48 48 + can_create_account: rbac 49 49 + .can_access_endpoint(did, "com.atproto.server.createAccount"), 50 50 + can_manage_invites: rbac 51 51 + .can_access_endpoint(did, "com.atproto.admin.getInviteCodes"), 52 52 + can_create_invite: rbac 53 53 + .can_access_endpoint(did, "com.atproto.server.createInviteCode"), 54 54 + can_send_email: rbac.can_access_endpoint(did, "com.atproto.admin.sendEmail"), 55 55 + can_request_crawl: rbac 56 56 + .can_access_endpoint(did, "com.atproto.sync.requestCrawl"), 57 57 + } 58 58 + } 59 59 + } 60 60 + 61 61 + /// Middleware that checks for a valid admin session cookie. 62 62 + /// If valid, injects AdminSession and AdminPermissions into request extensions. 63 63 + /// If invalid or missing, redirects to /admin/login. 64 64 + pub async fn admin_auth_middleware( 65 65 + State(state): State<AppState>, 66 66 + jar: SignedCookieJar, 67 67 + mut req: Request, 68 68 + next: Next, 69 69 + ) -> Response { 70 70 + let rbac = match &state.admin_rbac_config { 71 71 + Some(rbac) => rbac, 72 72 + None => return StatusCode::NOT_FOUND.into_response(), 73 73 + }; 74 74 + 75 75 + // Extract session ID from signed cookie 76 76 + let session_id = match jar.get("__gatekeeper_admin_session") { 77 77 + Some(cookie) => cookie.value().to_string(), 78 78 + None => return Redirect::to("/admin/login").into_response(), 79 79 + }; 80 80 + 81 81 + // Look up session in database 82 82 + let session_row = match session::get_session(&state.pds_gatekeeper_pool, &session_id).await { 83 83 + Ok(Some(row)) => row, 84 84 + Ok(None) => return Redirect::to("/admin/login").into_response(), 85 85 + Err(e) => { 86 86 + tracing::error!("Failed to look up admin session: {}", e); 87 87 + return Redirect::to("/admin/login").into_response(); 88 88 + } 89 89 + }; 90 90 + 91 91 + // Verify the DID is still a valid member 92 92 + if !rbac.is_member(&session_row.did) { 93 93 + return Redirect::to("/admin/login").into_response(); 94 94 + } 95 95 + 96 96 + let roles = rbac.get_member_roles(&session_row.did); 97 97 + let permissions = AdminPermissions::compute(rbac, &session_row.did); 98 98 + 99 99 + let admin_session = AdminSession { 100 100 + did: session_row.did, 101 101 + handle: session_row.handle, 102 102 + roles, 103 103 + }; 104 104 + 105 105 + req.extensions_mut().insert(admin_session); 106 106 + req.extensions_mut().insert(permissions); 107 107 + 108 108 + next.run(req).await 109 109 + }

+68

src/admin/mod.rs

··· 1 1 + pub mod middleware; 2 2 + pub mod oauth; 3 3 + pub mod pds_proxy; 4 4 + pub mod rbac; 5 5 + pub mod routes; 6 6 + pub mod session; 7 7 + pub mod static_files; 8 8 + pub mod store; 9 9 + 10 10 + use axum::{Router, middleware as ax_middleware, routing::get, routing::post}; 11 11 + 12 12 + use crate::AppState; 13 13 + 14 14 + /// Build the admin sub-router. 15 15 + /// Public routes (login, OAuth callback, client-metadata) are not behind auth middleware. 16 16 + /// All other admin routes require a valid session. 17 17 + pub fn router(state: AppState) -> Router<AppState> { 18 18 + // Routes that do NOT require authentication 19 19 + let public_routes = Router::new() 20 20 + .route("/", get(routes::dashboard)) 21 21 + .route("/login", get(oauth::get_login).post(oauth::post_login)) 22 22 + .route("/oauth/callback", get(oauth::oauth_callback)) 23 23 + .route("/client-metadata.json", get(oauth::client_metadata_json)) 24 24 + .route("/static/{*path}", get(static_files::serve_static)); 25 25 + 26 26 + // Routes that DO require authentication (via admin_auth middleware) 27 27 + let protected_routes = Router::new() 28 28 + .route("/dashboard", get(routes::dashboard)) 29 29 + .route("/accounts", get(routes::accounts_list)) 30 30 + .route("/accounts/{did}", get(routes::account_detail)) 31 31 + .route("/accounts/{did}/takedown", post(routes::takedown_account)) 32 32 + .route( 33 33 + "/accounts/{did}/untakedown", 34 34 + post(routes::untakedown_account), 35 35 + ) 36 36 + .route("/accounts/{did}/delete", post(routes::delete_account)) 37 37 + .route( 38 38 + "/accounts/{did}/reset-password", 39 39 + post(routes::reset_password), 40 40 + ) 41 41 + .route( 42 42 + "/accounts/{did}/disable-invites", 43 43 + post(routes::disable_account_invites), 44 44 + ) 45 45 + .route( 46 46 + "/accounts/{did}/enable-invites", 47 47 + post(routes::enable_account_invites), 48 48 + ) 49 49 + .route("/invite-codes", get(routes::invite_codes_list)) 50 50 + .route("/invite-codes/create", post(routes::create_invite_code)) 51 51 + .route("/invite-codes/disable", post(routes::disable_invite_codes)) 52 52 + .route( 53 53 + "/create-account", 54 54 + get(routes::get_create_account).post(routes::post_create_account), 55 55 + ) 56 56 + .route( 57 57 + "/request-crawl", 58 58 + get(routes::get_request_crawl).post(routes::post_request_crawl), 59 59 + ) 60 60 + .route("/logout", post(routes::logout)) 61 61 + .fallback(get(routes::dashboard)) 62 62 + .layer(ax_middleware::from_fn_with_state( 63 63 + state.clone(), 64 64 + middleware::admin_auth_middleware, 65 65 + )); 66 66 + 67 67 + Router::new().merge(public_routes).merge(protected_routes) 68 68 + }

+254

src/admin/oauth.rs

··· 1 1 + use super::session; 2 2 + use crate::AppState; 3 3 + use crate::admin::store::SqlAuthStore; 4 4 + use axum::{ 5 5 + extract::{Query, State}, 6 6 + http::StatusCode, 7 7 + response::{Html, IntoResponse, Redirect, Response}, 8 8 + }; 9 9 + use axum_extra::extract::cookie::{Cookie, SameSite, SignedCookieJar}; 10 10 + use jacquard_identity::JacquardResolver; 11 11 + use jacquard_oauth::session::ClientSessionData; 12 12 + use jacquard_oauth::{ 13 13 + atproto::{AtprotoClientMetadata, GrantType}, 14 14 + client::OAuthClient, 15 15 + session::ClientData, 16 16 + types::{AuthorizeOptions, CallbackParams}, 17 17 + }; 18 18 + use serde::Deserialize; 19 19 + use sqlx::SqlitePool; 20 20 + use tracing::log; 21 21 + 22 22 + /// Type alias for the concrete OAuthClient we use. 23 23 + pub type AdminOAuthClient = OAuthClient<JacquardResolver, SqlAuthStore>; 24 24 + 25 25 + /// Initialize the OAuth client for admin portal authentication. 26 26 + pub fn init_oauth_client( 27 27 + pds_hostname: &str, 28 28 + pool: SqlitePool, 29 29 + ) -> Result<AdminOAuthClient, anyhow::Error> { 30 30 + // Build client metadata 31 31 + let client_id = format!("https://{}/admin/client-metadata.json", pds_hostname) 32 32 + .parse() 33 33 + .map_err(|_: url::ParseError| anyhow::anyhow!("Invalid client_id URL"))?; 34 34 + let redirect_uri = format!("https://{}/admin/oauth/callback", pds_hostname) 35 35 + .parse() 36 36 + .map_err(|_: url::ParseError| anyhow::anyhow!("Invalid redirect_uri URL"))?; 37 37 + let client_uri = format!("https://{}/admin/", pds_hostname) 38 38 + .parse() 39 39 + .map_err(|_: url::ParseError| anyhow::anyhow!("Invalid client_uri URL"))?; 40 40 + 41 41 + let config = AtprotoClientMetadata::new( 42 42 + client_id, 43 43 + Some(client_uri), 44 44 + vec![redirect_uri], 45 45 + vec![GrantType::AuthorizationCode], 46 46 + vec![jacquard_oauth::scopes::Scope::parse("atproto").expect("valid scope")], 47 47 + None, 48 48 + ); 49 49 + 50 50 + let client_data = ClientData::new(None, config); 51 51 + let store = SqlAuthStore::new(pool); 52 52 + let client = OAuthClient::new(store, client_data); 53 53 + 54 54 + Ok(client) 55 55 + } 56 56 + 57 57 + /// GET /admin/client-metadata.json — Serves the OAuth client metadata. 58 58 + pub async fn client_metadata_json(State(state): State<AppState>) -> Response { 59 59 + let pds_hostname = &state.app_config.pds_hostname; 60 60 + let client_id = format!("https://{}/admin/client-metadata.json", pds_hostname); 61 61 + let redirect_uri = format!("https://{}/admin/oauth/callback", pds_hostname); 62 62 + let client_uri = format!("https://{}/admin/", pds_hostname); 63 63 + 64 64 + let metadata = serde_json::json!({ 65 65 + "client_id": client_id, 66 66 + "client_uri": client_uri, 67 67 + "redirect_uris": [redirect_uri], 68 68 + "grant_types": ["authorization_code"], 69 69 + "response_types": ["code"], 70 70 + "scope": "atproto", 71 71 + "token_endpoint_auth_method": "none", 72 72 + "application_type": "web", 73 73 + "dpop_bound_access_tokens": true, 74 74 + 75 75 + }); 76 76 + 77 77 + ( 78 78 + StatusCode::OK, 79 79 + [(axum::http::header::CONTENT_TYPE, "application/json")], 80 80 + serde_json::to_string_pretty(&metadata).unwrap_or_default(), 81 81 + ) 82 82 + .into_response() 83 83 + } 84 84 + 85 85 + /// GET /admin/login — Renders the login page. 86 86 + pub async fn get_login( 87 87 + State(state): State<AppState>, 88 88 + Query(params): Query<LoginQueryParams>, 89 89 + ) -> Response { 90 90 + let mut data = serde_json::json!({ 91 91 + "pds_hostname": state.app_config.pds_hostname, 92 92 + }); 93 93 + 94 94 + if let Some(error) = params.error { 95 95 + data["error"] = serde_json::Value::String(error); 96 96 + } 97 97 + 98 98 + use axum_template::TemplateEngine; 99 99 + match state.template_engine.render("admin/login.hbs", data) { 100 100 + Ok(html) => Html(html).into_response(), 101 101 + Err(e) => { 102 102 + tracing::error!("Failed to render login template: {}", e); 103 103 + StatusCode::INTERNAL_SERVER_ERROR.into_response() 104 104 + } 105 105 + } 106 106 + } 107 107 + 108 108 + #[derive(Debug, Deserialize)] 109 109 + pub struct LoginQueryParams { 110 110 + pub error: Option<String>, 111 111 + } 112 112 + 113 113 + #[derive(Debug, Deserialize)] 114 114 + pub struct LoginForm { 115 115 + pub handle: String, 116 116 + } 117 117 + 118 118 + /// POST /admin/login — Initiates the OAuth flow. 119 119 + pub async fn post_login( 120 120 + State(state): State<AppState>, 121 121 + axum::extract::Form(form): axum::extract::Form<LoginForm>, 122 122 + ) -> Response { 123 123 + let oauth_client: &AdminOAuthClient = match &state.admin_oauth_client { 124 124 + Some(client) => client, 125 125 + None => return StatusCode::NOT_FOUND.into_response(), 126 126 + }; 127 127 + 128 128 + let pds_hostname = &state.app_config.pds_hostname; 129 129 + let redirect_uri: url::Url = match format!("https://{}/admin/oauth/callback", pds_hostname) 130 130 + .parse() 131 131 + { 132 132 + Ok(u) => u, 133 133 + Err(_) => { 134 134 + return Redirect::to("/admin/login?error=Invalid+server+configuration").into_response(); 135 135 + } 136 136 + }; 137 137 + 138 138 + let options = AuthorizeOptions { 139 139 + redirect_uri: Some(redirect_uri), 140 140 + scopes: vec![ 141 141 + jacquard_oauth::scopes::Scope::parse("atproto").expect("valid scope"), 142 142 + jacquard_oauth::scopes::Scope::parse("transition:generic").expect("valid scope"), 143 143 + ], 144 144 + prompt: None, 145 145 + state: None, 146 146 + }; 147 147 + 148 148 + match oauth_client.start_auth(&form.handle, options).await { 149 149 + Ok(auth_url) => Redirect::to(&auth_url).into_response(), 150 150 + Err(e) => { 151 151 + tracing::error!("OAuth start_auth failed: {}", e); 152 152 + let msg = format!("Login failed: {}", e); 153 153 + let error_msg = urlencoding::encode(&msg); 154 154 + Redirect::to(&format!("/admin/login?error={}", error_msg)).into_response() 155 155 + } 156 156 + } 157 157 + } 158 158 + 159 159 + #[derive(Debug, Deserialize)] 160 160 + pub struct OAuthCallbackParams { 161 161 + pub code: String, 162 162 + pub state: Option<String>, 163 163 + pub iss: Option<String>, 164 164 + } 165 165 + 166 166 + /// GET /admin/oauth/callback — Handles the OAuth callback. 167 167 + pub async fn oauth_callback( 168 168 + State(state): State<AppState>, 169 169 + Query(params): Query<OAuthCallbackParams>, 170 170 + jar: SignedCookieJar, 171 171 + ) -> Response { 172 172 + let oauth_client: &AdminOAuthClient = match &state.admin_oauth_client { 173 173 + Some(client) => client, 174 174 + None => return StatusCode::NOT_FOUND.into_response(), 175 175 + }; 176 176 + 177 177 + let rbac = match &state.admin_rbac_config { 178 178 + Some(rbac) => rbac, 179 179 + None => return StatusCode::NOT_FOUND.into_response(), 180 180 + }; 181 181 + 182 182 + let callback_params = CallbackParams { 183 183 + code: params.code.as_str().into(), 184 184 + state: params.state.as_deref().map(Into::into), 185 185 + iss: params.iss.as_deref().map(Into::into), 186 186 + }; 187 187 + 188 188 + // Exchange authorization code for session 189 189 + let oauth_session = match oauth_client.callback(callback_params).await { 190 190 + Ok(session) => session, 191 191 + Err(e) => { 192 192 + tracing::error!("OAuth callback failed: {}", e); 193 193 + let msg = format!("Authentication failed: {}", e); 194 194 + let error_msg = urlencoding::encode(&msg); 195 195 + return Redirect::to(&format!("/admin/login?error={}", error_msg)).into_response(); 196 196 + } 197 197 + }; 198 198 + 199 199 + // Extract DID and handle from the OAuth session 200 200 + let (did, handle) = oauth_session.session_info().await; 201 201 + let did_str = did.to_string(); 202 202 + let handle_str = handle.to_string(); 203 203 + log::info!("Authenticated as DID {} ({})", did_str, handle_str); 204 204 + // Check if this DID is a member in the RBAC config 205 205 + if !rbac.is_member(&did_str) { 206 206 + tracing::warn!("Access denied for DID {} (not in RBAC config)", did_str); 207 207 + return render_error( 208 208 + &state, 209 209 + "Access Denied", 210 210 + &format!( 211 211 + "Your identity ({}) is not authorized to access the admin portal. Contact your PDS administrator.", 212 212 + handle_str 213 213 + ), 214 214 + ); 215 215 + } 216 216 + 217 217 + // Create admin session 218 218 + let ttl_hours = state.app_config.admin_session_ttl_hours; 219 219 + let session_id = 220 220 + match session::create_session(&state.pds_gatekeeper_pool, &did_str, &handle_str, ttl_hours) 221 221 + .await 222 222 + { 223 223 + Ok(id) => id, 224 224 + Err(e) => { 225 225 + tracing::error!("Failed to create admin session: {}", e); 226 226 + return Redirect::to("/admin/login?error=Session+creation+failed").into_response(); 227 227 + } 228 228 + }; 229 229 + 230 230 + // Set signed cookie 231 231 + let mut cookie = Cookie::new("__gatekeeper_admin_session", session_id); 232 232 + cookie.set_http_only(true); 233 233 + cookie.set_secure(true); 234 234 + cookie.set_same_site(SameSite::Lax); 235 235 + cookie.set_path("/admin/"); 236 236 + 237 237 + let updated_jar = jar.add(cookie); 238 238 + 239 239 + (updated_jar, Redirect::to("/admin/dashboard")).into_response() 240 240 + } 241 241 + 242 242 + fn render_error(state: &AppState, title: &str, message: &str) -> Response { 243 243 + let data = serde_json::json!({ 244 244 + "error_title": title, 245 245 + "error_message": message, 246 246 + "pds_hostname": state.app_config.pds_hostname, 247 247 + }); 248 248 + 249 249 + use axum_template::TemplateEngine; 250 250 + match state.template_engine.render("admin/error.hbs", data) { 251 251 + Ok(html) => Html(html).into_response(), 252 252 + Err(_) => (StatusCode::FORBIDDEN, format!("{}: {}", title, message)).into_response(), 253 253 + } 254 254 + }

+297

src/admin/pds_proxy.rs

··· 1 1 + use serde::de::DeserializeOwned; 2 2 + use serde::Serialize; 3 3 + use std::fmt; 4 4 + 5 5 + #[derive(Debug)] 6 6 + pub enum AdminProxyError { 7 7 + RequestFailed(String), 8 8 + PdsError { 9 9 + status: u16, 10 10 + error: String, 11 11 + message: String, 12 12 + }, 13 13 + ParseError(String), 14 14 + } 15 15 + 16 16 + impl fmt::Display for AdminProxyError { 17 17 + fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { 18 18 + match self { 19 19 + AdminProxyError::RequestFailed(msg) => write!(f, "Request failed: {msg}"), 20 20 + AdminProxyError::PdsError { 21 21 + status, 22 22 + error, 23 23 + message, 24 24 + } => write!(f, "PDS error ({status}): {error} - {message}"), 25 25 + AdminProxyError::ParseError(msg) => write!(f, "Parse error: {msg}"), 26 26 + } 27 27 + } 28 28 + } 29 29 + 30 30 + /// Make an authenticated GET request to a PDS XRPC endpoint. 31 31 + pub async fn admin_xrpc_get<R: DeserializeOwned>( 32 32 + pds_base_url: &str, 33 33 + admin_password: &str, 34 34 + endpoint: &str, 35 35 + query_params: &[(&str, &str)], 36 36 + ) -> Result<R, AdminProxyError> { 37 37 + let url = format!( 38 38 + "{}/xrpc/{}", 39 39 + pds_base_url.trim_end_matches('/'), 40 40 + endpoint 41 41 + ); 42 42 + let client = reqwest::Client::new(); 43 43 + let resp = client 44 44 + .get(&url) 45 45 + .query(query_params) 46 46 + .basic_auth("admin", Some(admin_password)) 47 47 + .send() 48 48 + .await 49 49 + .map_err(|e| AdminProxyError::RequestFailed(e.to_string()))?; 50 50 + 51 51 + if !resp.status().is_success() { 52 52 + let status = resp.status().as_u16(); 53 53 + let body = resp.text().await.unwrap_or_default(); 54 54 + if let Ok(err_json) = serde_json::from_str::<serde_json::Value>(&body) { 55 55 + return Err(AdminProxyError::PdsError { 56 56 + status, 57 57 + error: err_json["error"] 58 58 + .as_str() 59 59 + .unwrap_or("Unknown") 60 60 + .to_string(), 61 61 + message: err_json["message"] 62 62 + .as_str() 63 63 + .unwrap_or(&body) 64 64 + .to_string(), 65 65 + }); 66 66 + } 67 67 + return Err(AdminProxyError::PdsError { 68 68 + status, 69 69 + error: "Unknown".to_string(), 70 70 + message: body, 71 71 + }); 72 72 + } 73 73 + 74 74 + resp.json::<R>() 75 75 + .await 76 76 + .map_err(|e| AdminProxyError::ParseError(e.to_string())) 77 77 + } 78 78 + 79 79 + /// Make an authenticated POST request to a PDS XRPC endpoint. 80 80 + pub async fn admin_xrpc_post<T: Serialize, R: DeserializeOwned>( 81 81 + pds_base_url: &str, 82 82 + admin_password: &str, 83 83 + endpoint: &str, 84 84 + body: &T, 85 85 + ) -> Result<R, AdminProxyError> { 86 86 + let url = format!( 87 87 + "{}/xrpc/{}", 88 88 + pds_base_url.trim_end_matches('/'), 89 89 + endpoint 90 90 + ); 91 91 + let client = reqwest::Client::new(); 92 92 + let resp = client 93 93 + .post(&url) 94 94 + .json(body) 95 95 + .basic_auth("admin", Some(admin_password)) 96 96 + .send() 97 97 + .await 98 98 + .map_err(|e| AdminProxyError::RequestFailed(e.to_string()))?; 99 99 + 100 100 + if !resp.status().is_success() { 101 101 + let status = resp.status().as_u16(); 102 102 + let body = resp.text().await.unwrap_or_default(); 103 103 + if let Ok(err_json) = serde_json::from_str::<serde_json::Value>(&body) { 104 104 + return Err(AdminProxyError::PdsError { 105 105 + status, 106 106 + error: err_json["error"] 107 107 + .as_str() 108 108 + .unwrap_or("Unknown") 109 109 + .to_string(), 110 110 + message: err_json["message"] 111 111 + .as_str() 112 112 + .unwrap_or(&body) 113 113 + .to_string(), 114 114 + }); 115 115 + } 116 116 + return Err(AdminProxyError::PdsError { 117 117 + status, 118 118 + error: "Unknown".to_string(), 119 119 + message: body, 120 120 + }); 121 121 + } 122 122 + 123 123 + resp.json::<R>() 124 124 + .await 125 125 + .map_err(|e| AdminProxyError::ParseError(e.to_string())) 126 126 + } 127 127 + 128 128 + /// Make an authenticated POST request that returns no meaningful body (just success/failure). 129 129 + pub async fn admin_xrpc_post_no_response<T: Serialize>( 130 130 + pds_base_url: &str, 131 131 + admin_password: &str, 132 132 + endpoint: &str, 133 133 + body: &T, 134 134 + ) -> Result<(), AdminProxyError> { 135 135 + let url = format!( 136 136 + "{}/xrpc/{}", 137 137 + pds_base_url.trim_end_matches('/'), 138 138 + endpoint 139 139 + ); 140 140 + let client = reqwest::Client::new(); 141 141 + let resp = client 142 142 + .post(&url) 143 143 + .json(body) 144 144 + .basic_auth("admin", Some(admin_password)) 145 145 + .send() 146 146 + .await 147 147 + .map_err(|e| AdminProxyError::RequestFailed(e.to_string()))?; 148 148 + 149 149 + if !resp.status().is_success() { 150 150 + let status = resp.status().as_u16(); 151 151 + let body = resp.text().await.unwrap_or_default(); 152 152 + if let Ok(err_json) = serde_json::from_str::<serde_json::Value>(&body) { 153 153 + return Err(AdminProxyError::PdsError { 154 154 + status, 155 155 + error: err_json["error"] 156 156 + .as_str() 157 157 + .unwrap_or("Unknown") 158 158 + .to_string(), 159 159 + message: err_json["message"] 160 160 + .as_str() 161 161 + .unwrap_or(&body) 162 162 + .to_string(), 163 163 + }); 164 164 + } 165 165 + return Err(AdminProxyError::PdsError { 166 166 + status, 167 167 + error: "Unknown".to_string(), 168 168 + message: body, 169 169 + }); 170 170 + } 171 171 + 172 172 + Ok(()) 173 173 + } 174 174 + 175 175 + /// Make an unauthenticated GET request that returns text (e.g., _health). 176 176 + pub async fn get_text( 177 177 + pds_base_url: &str, 178 178 + endpoint: &str, 179 179 + ) -> Result<String, AdminProxyError> { 180 180 + let url = format!( 181 181 + "{}/{}", 182 182 + pds_base_url.trim_end_matches('/'), 183 183 + endpoint 184 184 + ); 185 185 + let client = reqwest::Client::new(); 186 186 + let resp = client 187 187 + .get(&url) 188 188 + .send() 189 189 + .await 190 190 + .map_err(|e| AdminProxyError::RequestFailed(e.to_string()))?; 191 191 + 192 192 + if !resp.status().is_success() { 193 193 + let status = resp.status().as_u16(); 194 194 + let body = resp.text().await.unwrap_or_default(); 195 195 + return Err(AdminProxyError::PdsError { 196 196 + status, 197 197 + error: "Unknown".to_string(), 198 198 + message: body, 199 199 + }); 200 200 + } 201 201 + 202 202 + resp.text() 203 203 + .await 204 204 + .map_err(|e| AdminProxyError::ParseError(e.to_string())) 205 205 + } 206 206 + 207 207 + /// Make an unauthenticated POST request to an arbitrary base URL (e.g., relay). 208 208 + pub async fn public_xrpc_post<T: Serialize>( 209 209 + base_url: &str, 210 210 + endpoint: &str, 211 211 + body: &T, 212 212 + ) -> Result<(), AdminProxyError> { 213 213 + let url = format!( 214 214 + "{}/xrpc/{}", 215 215 + base_url.trim_end_matches('/'), 216 216 + endpoint 217 217 + ); 218 218 + let client = reqwest::Client::new(); 219 219 + let resp = client 220 220 + .post(&url) 221 221 + .json(body) 222 222 + .send() 223 223 + .await 224 224 + .map_err(|e| AdminProxyError::RequestFailed(e.to_string()))?; 225 225 + 226 226 + if !resp.status().is_success() { 227 227 + let status = resp.status().as_u16(); 228 228 + let body = resp.text().await.unwrap_or_default(); 229 229 + if let Ok(err_json) = serde_json::from_str::<serde_json::Value>(&body) { 230 230 + return Err(AdminProxyError::PdsError { 231 231 + status, 232 232 + error: err_json["error"] 233 233 + .as_str() 234 234 + .unwrap_or("Unknown") 235 235 + .to_string(), 236 236 + message: err_json["message"] 237 237 + .as_str() 238 238 + .unwrap_or(&body) 239 239 + .to_string(), 240 240 + }); 241 241 + } 242 242 + return Err(AdminProxyError::PdsError { 243 243 + status, 244 244 + error: "Unknown".to_string(), 245 245 + message: body, 246 246 + }); 247 247 + } 248 248 + 249 249 + Ok(()) 250 250 + } 251 251 + 252 252 + /// Make an unauthenticated GET request with JSON response parsing. 253 253 + pub async fn public_xrpc_get<R: DeserializeOwned>( 254 254 + pds_base_url: &str, 255 255 + endpoint: &str, 256 256 + query_params: &[(&str, &str)], 257 257 + ) -> Result<R, AdminProxyError> { 258 258 + let url = format!( 259 259 + "{}/xrpc/{}", 260 260 + pds_base_url.trim_end_matches('/'), 261 261 + endpoint 262 262 + ); 263 263 + let client = reqwest::Client::new(); 264 264 + let resp = client 265 265 + .get(&url) 266 266 + .query(query_params) 267 267 + .send() 268 268 + .await 269 269 + .map_err(|e| AdminProxyError::RequestFailed(e.to_string()))?; 270 270 + 271 271 + if !resp.status().is_success() { 272 272 + let status = resp.status().as_u16(); 273 273 + let body = resp.text().await.unwrap_or_default(); 274 274 + if let Ok(err_json) = serde_json::from_str::<serde_json::Value>(&body) { 275 275 + return Err(AdminProxyError::PdsError { 276 276 + status, 277 277 + error: err_json["error"] 278 278 + .as_str() 279 279 + .unwrap_or("Unknown") 280 280 + .to_string(), 281 281 + message: err_json["message"] 282 282 + .as_str() 283 283 + .unwrap_or(&body) 284 284 + .to_string(), 285 285 + }); 286 286 + } 287 287 + return Err(AdminProxyError::PdsError { 288 288 + status, 289 289 + error: "Unknown".to_string(), 290 290 + message: body, 291 291 + }); 292 292 + } 293 293 + 294 294 + resp.json::<R>() 295 295 + .await 296 296 + .map_err(|e| AdminProxyError::ParseError(e.to_string())) 297 297 + }

+262

src/admin/rbac.rs

··· 1 1 + use serde::Deserialize; 2 2 + use std::collections::HashMap; 3 3 + use std::path::Path; 4 4 + 5 5 + #[derive(Debug, Clone, Deserialize)] 6 6 + pub struct RbacConfig { 7 7 + pub roles: HashMap<String, RoleDefinition>, 8 8 + pub members: Vec<MemberDefinition>, 9 9 + } 10 10 + 11 11 + #[derive(Debug, Clone, Deserialize)] 12 12 + pub struct RoleDefinition { 13 13 + pub description: String, 14 14 + pub endpoints: Vec<String>, 15 15 + } 16 16 + 17 17 + #[derive(Debug, Clone, Deserialize)] 18 18 + pub struct MemberDefinition { 19 19 + pub did: String, 20 20 + pub roles: Vec<String>, 21 21 + } 22 22 + 23 23 + impl RbacConfig { 24 24 + /// Load RBAC configuration from a YAML file. 25 25 + pub fn load_from_file(path: impl AsRef<Path>) -> Result<Self, anyhow::Error> { 26 26 + let contents = std::fs::read_to_string(path)?; 27 27 + let config: RbacConfig = serde_yaml::from_str(&contents)?; 28 28 + config.validate()?; 29 29 + Ok(config) 30 30 + } 31 31 + 32 32 + /// Validate that all member roles reference defined roles. 33 33 + fn validate(&self) -> Result<(), anyhow::Error> { 34 34 + for member in &self.members { 35 35 + for role in &member.roles { 36 36 + if !self.roles.contains_key(role) { 37 37 + return Err(anyhow::anyhow!( 38 38 + "Member {} references undefined role: {}", 39 39 + member.did, 40 40 + role 41 41 + )); 42 42 + } 43 43 + } 44 44 + } 45 45 + Ok(()) 46 46 + } 47 47 + 48 48 + /// Check whether a DID is a configured member. 49 49 + pub fn is_member(&self, did: &str) -> bool { 50 50 + self.members.iter().any(|m| m.did == did) 51 51 + } 52 52 + 53 53 + /// Get the role names assigned to a DID. 54 54 + pub fn get_member_roles(&self, did: &str) -> Vec<String> { 55 55 + self.members 56 56 + .iter() 57 57 + .find(|m| m.did == did) 58 58 + .map(|m| m.roles.clone()) 59 59 + .unwrap_or_default() 60 60 + } 61 61 + 62 62 + /// Get all endpoint patterns that a DID is allowed to access (aggregated from all roles). 63 63 + pub fn get_allowed_endpoints(&self, did: &str) -> Vec<String> { 64 64 + let roles = self.get_member_roles(did); 65 65 + let mut endpoints = Vec::new(); 66 66 + for role_name in &roles { 67 67 + if let Some(role) = self.roles.get(role_name) { 68 68 + endpoints.extend(role.endpoints.clone()); 69 69 + } 70 70 + } 71 71 + endpoints 72 72 + } 73 73 + 74 74 + /// Check whether a DID can access a specific endpoint. 75 75 + /// Supports wildcard matching: `com.atproto.admin.*` matches `com.atproto.admin.getAccountInfo`. 76 76 + pub fn can_access_endpoint(&self, did: &str, endpoint: &str) -> bool { 77 77 + let allowed = self.get_allowed_endpoints(did); 78 78 + for pattern in &allowed { 79 79 + if matches_endpoint_pattern(pattern, endpoint) { 80 80 + return true; 81 81 + } 82 82 + } 83 83 + false 84 84 + } 85 85 + } 86 86 + 87 87 + /// Match an endpoint against a pattern. Supports trailing `*` wildcard. 88 88 + /// e.g. `com.atproto.admin.*` matches `com.atproto.admin.getAccountInfo` 89 89 + fn matches_endpoint_pattern(pattern: &str, endpoint: &str) -> bool { 90 90 + if pattern == endpoint { 91 91 + return true; 92 92 + } 93 93 + if let Some(prefix) = pattern.strip_suffix('*') { 94 94 + return endpoint.starts_with(prefix); 95 95 + } 96 96 + false 97 97 + } 98 98 + 99 99 + #[cfg(test)] 100 100 + mod tests { 101 101 + use super::*; 102 102 + 103 103 + fn test_config() -> RbacConfig { 104 104 + let yaml = r#" 105 105 + roles: 106 106 + pds-admin: 107 107 + description: "Full admin" 108 108 + endpoints: 109 109 + - "com.atproto.admin.*" 110 110 + - "com.atproto.server.createInviteCode" 111 111 + - "com.atproto.server.createAccount" 112 112 + moderator: 113 113 + description: "Content moderation" 114 114 + endpoints: 115 115 + - "com.atproto.admin.getAccountInfo" 116 116 + - "com.atproto.admin.getAccountInfos" 117 117 + - "com.atproto.admin.getSubjectStatus" 118 118 + - "com.atproto.admin.updateSubjectStatus" 119 119 + - "com.atproto.admin.getInviteCodes" 120 120 + invite-manager: 121 121 + description: "Invite management" 122 122 + endpoints: 123 123 + - "com.atproto.admin.getInviteCodes" 124 124 + - "com.atproto.admin.disableInviteCodes" 125 125 + - "com.atproto.server.createInviteCode" 126 126 + 127 127 + members: 128 128 + - did: "did:plc:admin123" 129 129 + roles: 130 130 + - pds-admin 131 131 + - did: "did:plc:mod456" 132 132 + roles: 133 133 + - moderator 134 134 + - did: "did:plc:both789" 135 135 + roles: 136 136 + - moderator 137 137 + - invite-manager 138 138 + "#; 139 139 + serde_yaml::from_str(yaml).unwrap() 140 140 + } 141 141 + 142 142 + #[test] 143 143 + fn test_is_member() { 144 144 + let config = test_config(); 145 145 + assert!(config.is_member("did:plc:admin123")); 146 146 + assert!(config.is_member("did:plc:mod456")); 147 147 + assert!(!config.is_member("did:plc:unknown")); 148 148 + } 149 149 + 150 150 + #[test] 151 151 + fn test_get_member_roles() { 152 152 + let config = test_config(); 153 153 + assert_eq!(config.get_member_roles("did:plc:admin123"), vec!["pds-admin"]); 154 154 + assert_eq!( 155 155 + config.get_member_roles("did:plc:both789"), 156 156 + vec!["moderator", "invite-manager"] 157 157 + ); 158 158 + assert!(config.get_member_roles("did:plc:unknown").is_empty()); 159 159 + } 160 160 + 161 161 + #[test] 162 162 + fn test_wildcard_matching() { 163 163 + assert!(matches_endpoint_pattern( 164 164 + "com.atproto.admin.*", 165 165 + "com.atproto.admin.getAccountInfo" 166 166 + )); 167 167 + assert!(matches_endpoint_pattern( 168 168 + "com.atproto.admin.*", 169 169 + "com.atproto.admin.deleteAccount" 170 170 + )); 171 171 + assert!(!matches_endpoint_pattern( 172 172 + "com.atproto.admin.*", 173 173 + "com.atproto.server.createAccount" 174 174 + )); 175 175 + } 176 176 + 177 177 + #[test] 178 178 + fn test_exact_matching() { 179 179 + assert!(matches_endpoint_pattern( 180 180 + "com.atproto.server.createInviteCode", 181 181 + "com.atproto.server.createInviteCode" 182 182 + )); 183 183 + assert!(!matches_endpoint_pattern( 184 184 + "com.atproto.server.createInviteCode", 185 185 + "com.atproto.server.createAccount" 186 186 + )); 187 187 + } 188 188 + 189 189 + #[test] 190 190 + fn test_admin_can_access_all_admin_endpoints() { 191 191 + let config = test_config(); 192 192 + assert!(config.can_access_endpoint("did:plc:admin123", "com.atproto.admin.getAccountInfo")); 193 193 + assert!(config.can_access_endpoint("did:plc:admin123", "com.atproto.admin.deleteAccount")); 194 194 + assert!(config.can_access_endpoint( 195 195 + "did:plc:admin123", 196 196 + "com.atproto.server.createInviteCode" 197 197 + )); 198 198 + assert!(config.can_access_endpoint("did:plc:admin123", "com.atproto.server.createAccount")); 199 199 + } 200 200 + 201 201 + #[test] 202 202 + fn test_moderator_limited_access() { 203 203 + let config = test_config(); 204 204 + assert!(config.can_access_endpoint("did:plc:mod456", "com.atproto.admin.getAccountInfo")); 205 205 + assert!(config.can_access_endpoint( 206 206 + "did:plc:mod456", 207 207 + "com.atproto.admin.updateSubjectStatus" 208 208 + )); 209 209 + assert!(!config.can_access_endpoint("did:plc:mod456", "com.atproto.admin.deleteAccount")); 210 210 + assert!(!config.can_access_endpoint( 211 211 + "did:plc:mod456", 212 212 + "com.atproto.server.createInviteCode" 213 213 + )); 214 214 + } 215 215 + 216 216 + #[test] 217 217 + fn test_combined_roles() { 218 218 + let config = test_config(); 219 219 + // Has moderator + invite-manager 220 220 + assert!(config.can_access_endpoint("did:plc:both789", "com.atproto.admin.getAccountInfo")); 221 221 + assert!(config.can_access_endpoint("did:plc:both789", "com.atproto.admin.getInviteCodes")); 222 222 + assert!(config.can_access_endpoint( 223 223 + "did:plc:both789", 224 224 + "com.atproto.server.createInviteCode" 225 225 + )); 226 226 + assert!(config.can_access_endpoint( 227 227 + "did:plc:both789", 228 228 + "com.atproto.admin.disableInviteCodes" 229 229 + )); 230 230 + // But not delete or create account 231 231 + assert!(!config.can_access_endpoint("did:plc:both789", "com.atproto.admin.deleteAccount")); 232 232 + assert!(!config.can_access_endpoint( 233 233 + "did:plc:both789", 234 234 + "com.atproto.server.createAccount" 235 235 + )); 236 236 + } 237 237 + 238 238 + #[test] 239 239 + fn test_non_member_no_access() { 240 240 + let config = test_config(); 241 241 + assert!(!config.can_access_endpoint( 242 242 + "did:plc:unknown", 243 243 + "com.atproto.admin.getAccountInfo" 244 244 + )); 245 245 + } 246 246 + 247 247 + #[test] 248 248 + fn test_validate_rejects_undefined_role() { 249 249 + let yaml = r#" 250 250 + roles: 251 251 + admin: 252 252 + description: "Admin" 253 253 + endpoints: ["com.atproto.admin.*"] 254 254 + members: 255 255 + - did: "did:plc:test" 256 256 + roles: 257 257 + - nonexistent 258 258 + "#; 259 259 + let config: RbacConfig = serde_yaml::from_str(yaml).unwrap(); 260 260 + assert!(config.validate().is_err()); 261 261 + } 262 262 + }

+1280

src/admin/routes.rs

··· 1 1 + use super::middleware::{AdminPermissions, AdminSession}; 2 2 + use super::pds_proxy; 3 3 + use super::session; 4 4 + use crate::AppState; 5 5 + use axum::{ 6 6 + extract::{Extension, Path, Query, State}, 7 7 + http::StatusCode, 8 8 + response::{Html, IntoResponse, Redirect, Response}, 9 9 + }; 10 10 + use axum_extra::extract::cookie::{Cookie, SignedCookieJar}; 11 11 + use jacquard::client::BasicClient; 12 12 + use jacquard_common::types::handle::Handle; 13 13 + use jacquard_identity::resolver::IdentityResolver; 14 14 + use serde::Deserialize; 15 15 + use tracing::log; 16 16 + 17 17 + // ─── Query parameter types ─────────────────────────────────────────────────── 18 18 + 19 19 + #[derive(Debug, Deserialize)] 20 20 + pub struct FlashParams { 21 21 + pub flash_success: Option<String>, 22 22 + pub flash_error: Option<String>, 23 23 + } 24 24 + 25 25 + #[derive(Debug, Deserialize)] 26 26 + pub struct AccountDetailParams { 27 27 + pub flash_success: Option<String>, 28 28 + pub flash_error: Option<String>, 29 29 + pub new_password: Option<String>, 30 30 + pub direct_lookup: Option<String>, 31 31 + } 32 32 + 33 33 + #[derive(Debug, Deserialize)] 34 34 + pub struct AccountsParams { 35 35 + pub cursor: Option<String>, 36 36 + pub prev_cursor: Option<String>, 37 37 + pub flash_success: Option<String>, 38 38 + pub flash_error: Option<String>, 39 39 + } 40 40 + 41 41 + #[derive(Debug, Deserialize)] 42 42 + pub struct InviteCodesParams { 43 43 + pub cursor: Option<String>, 44 44 + pub flash_success: Option<String>, 45 45 + pub flash_error: Option<String>, 46 46 + } 47 47 + 48 48 + // ─── Form types ────────────────────────────────────────────────────────────── 49 49 + 50 50 + #[derive(Debug, Deserialize)] 51 51 + pub struct CreateInviteForm { 52 52 + pub use_count: Option<i64>, 53 53 + } 54 54 + 55 55 + #[derive(Debug, Deserialize)] 56 56 + pub struct DisableInviteCodesForm { 57 57 + pub codes: String, // comma-separated 58 58 + } 59 59 + 60 60 + #[derive(Debug, Deserialize)] 61 61 + pub struct CreateAccountForm { 62 62 + pub email: String, 63 63 + pub handle: String, 64 64 + } 65 65 + 66 66 + #[derive(Debug, Deserialize)] 67 67 + pub struct RequestCrawlForm { 68 68 + pub relay_host: String, 69 69 + } 70 70 + 71 71 + // ─── Helper functions ──────────────────────────────────────────────────────── 72 72 + 73 73 + fn admin_password(state: &AppState) -> &str { 74 74 + state.app_config.pds_admin_password.as_deref().unwrap_or("") 75 75 + } 76 76 + 77 77 + fn pds_url(state: &AppState) -> &str { 78 78 + &state.app_config.pds_base_url 79 79 + } 80 80 + 81 81 + fn render_template(state: &AppState, template: &str, data: serde_json::Value) -> Response { 82 82 + use axum_template::TemplateEngine; 83 83 + match state.template_engine.render(template, data) { 84 84 + Ok(html) => Html(html).into_response(), 85 85 + Err(e) => { 86 86 + tracing::error!("Template render error for {}: {}", template, e); 87 87 + StatusCode::INTERNAL_SERVER_ERROR.into_response() 88 88 + } 89 89 + } 90 90 + } 91 91 + 92 92 + fn inject_nav_data( 93 93 + data: &mut serde_json::Value, 94 94 + session: &AdminSession, 95 95 + permissions: &AdminPermissions, 96 96 + ) { 97 97 + let obj = data.as_object_mut().unwrap(); 98 98 + // Bug 1 fix: templates reference {{handle}}, not {{admin_handle}} 99 99 + obj.insert("handle".into(), session.handle.clone().into()); 100 100 + obj.insert("admin_did".into(), session.did.clone().into()); 101 101 + obj.insert( 102 102 + "can_view_accounts".into(), 103 103 + permissions.can_view_accounts.into(), 104 104 + ); 105 105 + obj.insert( 106 106 + "can_manage_takedowns".into(), 107 107 + permissions.can_manage_takedowns.into(), 108 108 + ); 109 109 + obj.insert( 110 110 + "can_delete_account".into(), 111 111 + permissions.can_delete_account.into(), 112 112 + ); 113 113 + obj.insert( 114 114 + "can_reset_password".into(), 115 115 + permissions.can_reset_password.into(), 116 116 + ); 117 117 + obj.insert( 118 118 + "can_create_account".into(), 119 119 + permissions.can_create_account.into(), 120 120 + ); 121 121 + obj.insert( 122 122 + "can_manage_invites".into(), 123 123 + permissions.can_manage_invites.into(), 124 124 + ); 125 125 + obj.insert( 126 126 + "can_create_invite".into(), 127 127 + permissions.can_create_invite.into(), 128 128 + ); 129 129 + obj.insert("can_send_email".into(), permissions.can_send_email.into()); 130 130 + obj.insert( 131 131 + "can_request_crawl".into(), 132 132 + permissions.can_request_crawl.into(), 133 133 + ); 134 134 + } 135 135 + 136 136 + fn flash_redirect(base_path: &str, success: Option<&str>, error: Option<&str>) -> Response { 137 137 + let mut url = base_path.to_string(); 138 138 + let mut sep = '?'; 139 139 + if let Some(msg) = success { 140 140 + url.push_str(&format!( 141 141 + "{}flash_success={}", 142 142 + sep, 143 143 + urlencoding::encode(msg) 144 144 + )); 145 145 + sep = '&'; 146 146 + } 147 147 + if let Some(msg) = error { 148 148 + url.push_str(&format!("{}flash_error={}", sep, urlencoding::encode(msg))); 149 149 + } 150 150 + Redirect::to(&url).into_response() 151 151 + } 152 152 + 153 153 + fn generate_random_password() -> String { 154 154 + use rand::Rng; 155 155 + let chars = b"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_"; 156 156 + let mut rng = rand::rng(); 157 157 + (0..24) 158 158 + .map(|_| chars[rng.random_range(0..chars.len())] as char) 159 159 + .collect() 160 160 + } 161 161 + 162 162 + // ─── Route handlers ────────────────────────────────────────────────────────── 163 163 + 164 164 + /// GET /admin/dashboard — Dashboard 165 165 + pub async fn dashboard( 166 166 + State(state): State<AppState>, 167 167 + Extension(session): Extension<AdminSession>, 168 168 + Extension(permissions): Extension<AdminPermissions>, 169 169 + Query(flash): Query<FlashParams>, 170 170 + ) -> Response { 171 171 + let pds = pds_url(&state); 172 172 + 173 173 + // Fetch health and server description in parallel 174 174 + let health_fut = pds_proxy::get_text(pds, "xrpc/_health"); 175 175 + let desc_fut = pds_proxy::public_xrpc_get::<serde_json::Value>( 176 176 + pds, 177 177 + "com.atproto.server.describeServer", 178 178 + &[], 179 179 + ); 180 180 + 181 181 + let (health_res, desc_res) = tokio::join!(health_fut, desc_fut); 182 182 + 183 183 + let version = health_res 184 184 + .ok() 185 185 + .and_then(|t| { 186 186 + serde_json::from_str::<serde_json::Value>(&t) 187 187 + .ok() 188 188 + .and_then(|h| h["version"].as_str().map(|s| s.to_string())) 189 189 + }) 190 190 + .unwrap_or_else(|| "Unknown".to_string()); 191 191 + 192 192 + let desc = desc_res.ok(); 193 193 + 194 194 + // Conditionally fetch account count only if admin can view accounts 195 195 + let account_count = if permissions.can_view_accounts { 196 196 + pds_proxy::public_xrpc_get::<serde_json::Value>( 197 197 + pds, 198 198 + "com.atproto.sync.listRepos", 199 199 + &[("limit", "1000")], 200 200 + ) 201 201 + .await 202 202 + .ok() 203 203 + .and_then(|r| r["repos"].as_array().map(|a| a.len())) 204 204 + .unwrap_or(0) 205 205 + } else { 206 206 + 0 207 207 + }; 208 208 + 209 209 + // Extract describeServer fields (Gap 1) 210 210 + let server_did = desc 211 211 + .as_ref() 212 212 + .and_then(|d| d["did"].as_str()) 213 213 + .unwrap_or_default() 214 214 + .to_string(); 215 215 + let available_domains: Vec<String> = desc 216 216 + .as_ref() 217 217 + .and_then(|d| d["availableUserDomains"].as_array()) 218 218 + .map(|arr| { 219 219 + arr.iter() 220 220 + .filter_map(|v| v.as_str().map(|s| s.to_string())) 221 221 + .collect() 222 222 + }) 223 223 + .unwrap_or_default(); 224 224 + let invite_code_required = desc 225 225 + .as_ref() 226 226 + .and_then(|d| d["inviteCodeRequired"].as_bool()) 227 227 + .unwrap_or(false); 228 228 + let phone_verification_required = desc 229 229 + .as_ref() 230 230 + .and_then(|d| d["phoneVerificationRequired"].as_bool()) 231 231 + .unwrap_or(false); 232 232 + 233 233 + // Gap 1: server links 234 234 + let privacy_policy = desc 235 235 + .as_ref() 236 236 + .and_then(|d| d["links"]["privacyPolicy"].as_str()) 237 237 + .map(|s| s.to_string()); 238 238 + let terms_of_service = desc 239 239 + .as_ref() 240 240 + .and_then(|d| d["links"]["termsOfService"].as_str()) 241 241 + .map(|s| s.to_string()); 242 242 + 243 243 + // Gap 1: contact email 244 244 + let contact_email = desc 245 245 + .as_ref() 246 246 + .and_then(|d| d["contact"]["email"].as_str()) 247 247 + .map(|s| s.to_string()); 248 248 + 249 249 + let mut data = serde_json::json!({ 250 250 + "version": version, 251 251 + "account_count": account_count, 252 252 + "server_did": server_did, 253 253 + "available_domains": available_domains, 254 254 + "invite_code_required": invite_code_required, 255 255 + "phone_verification_required": phone_verification_required, 256 256 + "pds_hostname": state.app_config.pds_hostname, 257 257 + "active_page": "dashboard", 258 258 + }); 259 259 + 260 260 + if let Some(url) = privacy_policy { 261 261 + data["privacy_policy"] = url.into(); 262 262 + } 263 263 + if let Some(url) = terms_of_service { 264 264 + data["terms_of_service"] = url.into(); 265 265 + } 266 266 + if let Some(email) = contact_email { 267 267 + data["contact_email"] = email.into(); 268 268 + } 269 269 + 270 270 + if let Some(msg) = flash.flash_success { 271 271 + data["flash_success"] = msg.into(); 272 272 + } 273 273 + if let Some(msg) = flash.flash_error { 274 274 + data["flash_error"] = msg.into(); 275 275 + } 276 276 + 277 277 + inject_nav_data(&mut data, &session, &permissions); 278 278 + 279 279 + render_template(&state, "admin/dashboard.hbs", data) 280 280 + } 281 281 + 282 282 + /// GET /admin/accounts — Account list (paginated) 283 283 + pub async fn accounts_list( 284 284 + State(state): State<AppState>, 285 285 + Extension(session): Extension<AdminSession>, 286 286 + Extension(permissions): Extension<AdminPermissions>, 287 287 + Query(params): Query<AccountsParams>, 288 288 + ) -> Response { 289 289 + if !permissions.can_view_accounts { 290 290 + return flash_redirect("/admin/dashboard", None, Some("Access denied")); 291 291 + } 292 292 + 293 293 + let pds = pds_url(&state); 294 294 + let password = admin_password(&state); 295 295 + 296 296 + let limit = 100; 297 297 + let limit_as_string = limit.to_string(); 298 298 + 299 299 + let mut repo_infos: std::collections::HashMap<String, (bool, Option<String>)> = 300 300 + std::collections::HashMap::new(); 301 301 + 302 302 + // Regular list 303 303 + let mut query_params: Vec<(&str, &str)> = vec![("limit", &limit_as_string)]; 304 304 + let cursor_val; 305 305 + if let Some(ref c) = params.cursor { 306 306 + cursor_val = c.clone(); 307 307 + query_params.push(("cursor", &cursor_val)); 308 308 + } 309 309 + 310 310 + let (accounts_raw, next_cursor) = match pds_proxy::public_xrpc_get::<serde_json::Value>( 311 311 + pds, 312 312 + "com.atproto.sync.listRepos", 313 313 + &query_params, 314 314 + ) 315 315 + .await 316 316 + { 317 317 + Ok(repos) => { 318 318 + let next_cursor = repos["cursor"].as_str().map(|s| s.to_string()); 319 319 + if let Some(arr) = repos["repos"].as_array() { 320 320 + for r in arr { 321 321 + if let Some(did) = r["did"].as_str() { 322 322 + let active = r["active"].as_bool().unwrap_or(true); 323 323 + let status = r["status"].as_str().map(|s| s.to_string()); 324 324 + repo_infos.insert(did.to_string(), (active, status)); 325 325 + } 326 326 + } 327 327 + } 328 328 + 329 329 + let dids: Vec<String> = repo_infos.keys().cloned().collect(); 330 330 + 331 331 + if !dids.is_empty() { 332 332 + let did_params: Vec<(&str, &str)> = 333 333 + dids.iter().map(|d| ("dids", d.as_str())).collect(); 334 334 + match pds_proxy::admin_xrpc_get::<serde_json::Value>( 335 335 + pds, 336 336 + password, 337 337 + "com.atproto.admin.getAccountInfos", 338 338 + &did_params, 339 339 + ) 340 340 + .await 341 341 + { 342 342 + Ok(res) => (res["infos"].clone(), next_cursor), 343 343 + Err(e) => { 344 344 + tracing::error!("Failed to get account infos: {}", e); 345 345 + (serde_json::json!([]), next_cursor) 346 346 + } 347 347 + } 348 348 + } else { 349 349 + (serde_json::json!([]), next_cursor) 350 350 + } 351 351 + } 352 352 + Err(e) => { 353 353 + tracing::error!("Failed to list repos: {}", e); 354 354 + return flash_redirect( 355 355 + "/admin/dashboard", 356 356 + None, 357 357 + Some(&format!("Failed to list accounts: {}", e)), 358 358 + ); 359 359 + } 360 360 + }; 361 361 + 362 362 + let accounts: Vec<serde_json::Value> = if let Some(arr) = accounts_raw.as_array() { 363 363 + let mut processed = Vec::new(); 364 364 + for account in arr { 365 365 + let mut a = account.clone(); 366 366 + let did = a["did"].as_str().unwrap_or_default(); 367 367 + 368 368 + // Enrichment from listRepos if available 369 369 + if let Some((active, status)) = repo_infos.get(did) { 370 370 + let is_taken_down = !*active && status.as_deref() != Some("deactivated"); 371 371 + a["is_taken_down"] = is_taken_down.into(); 372 372 + 373 373 + if a["status"].is_null() { 374 374 + if let Some(s) = status { 375 375 + a["status"] = s.clone().into(); 376 376 + } 377 377 + } 378 378 + } else { 379 379 + // If we don't have repo info for this DID (shouldn't happen with our logic) 380 380 + a["is_taken_down"] = false.into(); 381 381 + } 382 382 + processed.push(a); 383 383 + } 384 384 + processed 385 385 + } else { 386 386 + Vec::new() 387 387 + }; 388 388 + 389 389 + let account_count = accounts.len(); 390 390 + 391 391 + let mut data = serde_json::json!({ 392 392 + "accounts": accounts, 393 393 + "account_count": account_count, 394 394 + "pds_hostname": state.app_config.pds_hostname, 395 395 + "active_page": "accounts", 396 396 + }); 397 397 + 398 398 + // Pagination: "Next" link 399 399 + if let Some(ref cursor) = next_cursor { 400 400 + if accounts.len() >= limit { 401 401 + data["has_next"] = true.into(); 402 402 + let mut next_url = format!("/admin/accounts?cursor={}", urlencoding::encode(cursor)); 403 403 + if let Some(ref current_cursor) = params.cursor { 404 404 + next_url.push_str(&format!( 405 405 + "&prev_cursor={}", 406 406 + urlencoding::encode(current_cursor) 407 407 + )); 408 408 + } 409 409 + data["next_url"] = next_url.into(); 410 410 + } 411 411 + } 412 412 + 413 413 + // Pagination: "Previous" link 414 414 + if params.cursor.is_some() { 415 415 + data["has_prev"] = true.into(); 416 416 + let mut prev_url = "/admin/accounts".to_string(); 417 417 + if let Some(ref prev_cursor) = params.prev_cursor { 418 418 + prev_url.push_str(&format!("?cursor={}", urlencoding::encode(prev_cursor))); 419 419 + } 420 420 + data["prev_url"] = prev_url.into(); 421 421 + } 422 422 + 423 423 + if let Some(msg) = &params.flash_success { 424 424 + data["flash_success"] = msg.clone().into(); 425 425 + } 426 426 + if let Some(msg) = &params.flash_error { 427 427 + data["flash_error"] = msg.clone().into(); 428 428 + } 429 429 + 430 430 + inject_nav_data(&mut data, &session, &permissions); 431 431 + 432 432 + render_template(&state, "admin/accounts.hbs", data) 433 433 + } 434 434 + 435 435 + /// GET /admin/accounts/:did — Account detail 436 436 + pub async fn account_detail( 437 437 + State(state): State<AppState>, 438 438 + Extension(session): Extension<AdminSession>, 439 439 + Extension(permissions): Extension<AdminPermissions>, 440 440 + Path(did): Path<String>, 441 441 + Query(params): Query<AccountDetailParams>, 442 442 + ) -> Response { 443 443 + if !permissions.can_view_accounts { 444 444 + return flash_redirect("/admin/dashboard", None, Some("Access denied")); 445 445 + } 446 446 + 447 447 + let pds = pds_url(&state); 448 448 + let password = admin_password(&state); 449 449 + 450 450 + let mut look_up_did: String = params.direct_lookup.unwrap_or_else(|| did); 451 451 + 452 452 + if !look_up_did.starts_with("did") { 453 453 + let handle = match Handle::new(&look_up_did) { 454 454 + Ok(h) => h, 455 455 + Err(e) => { 456 456 + tracing::warn!("Invalid handle '{}': {}", look_up_did, e); 457 457 + return flash_redirect( 458 458 + "/admin/accounts", 459 459 + None, 460 460 + Some(&format!("Invalid handle '{}': {}", look_up_did, e)), 461 461 + ); 462 462 + } 463 463 + }; 464 464 + let client = BasicClient::unauthenticated(); 465 465 + 466 466 + tracing::debug!("Resolving handle: {}", handle); 467 467 + look_up_did = match client.resolve_handle(&handle).await { 468 468 + Ok(did) => did.to_string(), 469 469 + Err(e) => { 470 470 + tracing::warn!("Failed to resolve handle '{}': {}", handle, e); 471 471 + return flash_redirect( 472 472 + "/admin/accounts", 473 473 + None, 474 474 + Some(&format!("Could not resolve handle '{}': {}", handle, e)), 475 475 + ); 476 476 + } 477 477 + }; 478 478 + } 479 479 + 480 480 + // Fetch account info, subject status, repo description, and repo status in parallel 481 481 + let did_param: Vec<(&str, &str)> = vec![("did", look_up_did.as_str())]; 482 482 + let account_fut = pds_proxy::admin_xrpc_get::<serde_json::Value>( 483 483 + pds, 484 484 + password, 485 485 + "com.atproto.admin.getAccountInfo", 486 486 + &did_param, 487 487 + ); 488 488 + 489 489 + let did_param2: Vec<(&str, &str)> = vec![("did", look_up_did.as_str())]; 490 490 + let status_fut = pds_proxy::admin_xrpc_get::<serde_json::Value>( 491 491 + pds, 492 492 + password, 493 493 + "com.atproto.admin.getSubjectStatus", 494 494 + &did_param2, 495 495 + ); 496 496 + 497 497 + // Gap 2: fetch repo description (public, no auth needed) 498 498 + let repo_param: Vec<(&str, &str)> = vec![("repo", look_up_did.as_str())]; 499 499 + let describe_repo_fut = pds_proxy::public_xrpc_get::<serde_json::Value>( 500 500 + pds, 501 501 + "com.atproto.repo.describeRepo", 502 502 + &repo_param, 503 503 + ); 504 504 + 505 505 + // Gap 2: fetch repo status (public, no auth needed) 506 506 + let did_param3: Vec<(&str, &str)> = vec![("did", look_up_did.as_str())]; 507 507 + let repo_status_fut = pds_proxy::public_xrpc_get::<serde_json::Value>( 508 508 + pds, 509 509 + "com.atproto.sync.getRepoStatus", 510 510 + &did_param3, 511 511 + ); 512 512 + 513 513 + let (account_res, status_res, describe_repo_res, repo_status_res) = 514 514 + tokio::join!(account_fut, status_fut, describe_repo_fut, repo_status_fut); 515 515 + 516 516 + let account = match account_res { 517 517 + Ok(a) => a, 518 518 + Err(e) => { 519 519 + tracing::error!("Failed to get account info for {}: {}", look_up_did, e); 520 520 + return flash_redirect( 521 521 + "/admin/accounts", 522 522 + None, 523 523 + Some(&format!("Failed to get account: {}", e)), 524 524 + ); 525 525 + } 526 526 + }; 527 527 + 528 528 + let status_val = status_res.ok(); 529 529 + let takedown_applied = status_val 530 530 + .as_ref() 531 531 + .and_then(|s| s["takedown"]["applied"].as_bool()) 532 532 + .unwrap_or(false); 533 533 + let takedown_ref = status_val 534 534 + .as_ref() 535 535 + .and_then(|s| s["takedown"]["ref"].as_str()) 536 536 + .map(|s| s.to_string()); 537 537 + 538 538 + // Gap 2: extract repo description data 539 539 + let describe_repo = describe_repo_res.ok(); 540 540 + let handle_is_correct = describe_repo 541 541 + .as_ref() 542 542 + .and_then(|d| d["handleIsCorrect"].as_bool()); 543 543 + let collections: Vec<String> = describe_repo 544 544 + .as_ref() 545 545 + .and_then(|d| d["collections"].as_array()) 546 546 + .map(|arr| { 547 547 + arr.iter() 548 548 + .filter_map(|v| v.as_str().map(|s| s.to_string())) 549 549 + .collect() 550 550 + }) 551 551 + .unwrap_or_default(); 552 552 + 553 553 + // Gap 2: extract repo status data 554 554 + let repo_status = repo_status_res.ok(); 555 555 + let repo_active = repo_status.as_ref().and_then(|r| r["active"].as_bool()); 556 556 + let repo_status_reason = repo_status 557 557 + .as_ref() 558 558 + .and_then(|r| r["status"].as_str()) 559 559 + .map(|s| s.to_string()); 560 560 + let repo_rev = repo_status 561 561 + .as_ref() 562 562 + .and_then(|r| r["rev"].as_str()) 563 563 + .map(|s| s.to_string()); 564 564 + 565 565 + // Extract threat signatures from account view 566 566 + let threat_signatures = account["threatSignatures"].clone(); 567 567 + 568 568 + let mut data = serde_json::json!({ 569 569 + "account": account, 570 570 + "is_taken_down": takedown_applied, 571 571 + "pds_hostname": state.app_config.pds_hostname, 572 572 + "active_page": "accounts", 573 573 + }); 574 574 + 575 575 + // Gap 2: add repo description data 576 576 + if let Some(correct) = handle_is_correct { 577 577 + data["handle_is_correct"] = correct.into(); 578 578 + data["handle_resolution_checked"] = true.into(); 579 579 + } 580 580 + if !collections.is_empty() { 581 581 + data["collections"] = serde_json::json!(collections); 582 582 + } 583 583 + 584 584 + // Gap 2: add repo status data 585 585 + if let Some(active) = repo_active { 586 586 + data["repo_active"] = active.into(); 587 587 + data["repo_status_checked"] = true.into(); 588 588 + } 589 589 + if let Some(reason) = repo_status_reason { 590 590 + data["repo_status_reason"] = reason.into(); 591 591 + } 592 592 + if let Some(rev) = repo_rev { 593 593 + data["repo_rev"] = rev.into(); 594 594 + } 595 595 + 596 596 + // Takedown reference 597 597 + if let Some(tref) = takedown_ref { 598 598 + data["takedown_ref"] = tref.into(); 599 599 + } 600 600 + 601 601 + // Threat signatures 602 602 + if threat_signatures.is_array() && !threat_signatures.as_array().unwrap().is_empty() { 603 603 + data["threat_signatures"] = threat_signatures; 604 604 + } 605 605 + 606 606 + // Bug 3 fix: pass new_password from query params into template data 607 607 + if let Some(pw) = params.new_password { 608 608 + data["new_password"] = pw.into(); 609 609 + } 610 610 + 611 611 + if let Some(msg) = params.flash_success { 612 612 + data["flash_success"] = msg.into(); 613 613 + } 614 614 + if let Some(msg) = params.flash_error { 615 615 + data["flash_error"] = msg.into(); 616 616 + } 617 617 + 618 618 + inject_nav_data(&mut data, &session, &permissions); 619 619 + 620 620 + render_template(&state, "admin/account_detail.hbs", data) 621 621 + } 622 622 + 623 623 + /// POST /admin/accounts/:did/takedown 624 624 + pub async fn takedown_account( 625 625 + State(state): State<AppState>, 626 626 + Extension(session): Extension<AdminSession>, 627 627 + Extension(_permissions): Extension<AdminPermissions>, 628 628 + Path(did): Path<String>, 629 629 + ) -> Response { 630 630 + let rbac = match &state.admin_rbac_config { 631 631 + Some(r) => r, 632 632 + None => return StatusCode::NOT_FOUND.into_response(), 633 633 + }; 634 634 + 635 635 + if !rbac.can_access_endpoint(&session.did, "com.atproto.admin.updateSubjectStatus") { 636 636 + return flash_redirect( 637 637 + &format!("/admin/accounts/{}", did), 638 638 + None, 639 639 + Some("Access denied: cannot manage takedowns"), 640 640 + ); 641 641 + } 642 642 + 643 643 + let body = serde_json::json!({ 644 644 + "subject": { 645 645 + "$type": "com.atproto.admin.defs#repoRef", 646 646 + "did": did, 647 647 + }, 648 648 + "takedown": { 649 649 + "applied": true, 650 650 + "ref": chrono::Utc::now().timestamp().to_string(), 651 651 + }, 652 652 + }); 653 653 + 654 654 + match pds_proxy::admin_xrpc_post_no_response( 655 655 + pds_url(&state), 656 656 + admin_password(&state), 657 657 + "com.atproto.admin.updateSubjectStatus", 658 658 + &body, 659 659 + ) 660 660 + .await 661 661 + { 662 662 + Ok(()) => flash_redirect( 663 663 + &format!("/admin/accounts/{}", did), 664 664 + Some("Account taken down successfully"), 665 665 + None, 666 666 + ), 667 667 + Err(e) => flash_redirect( 668 668 + &format!("/admin/accounts/{}", did), 669 669 + None, 670 670 + Some(&format!("Takedown failed: {}", e)), 671 671 + ), 672 672 + } 673 673 + } 674 674 + 675 675 + /// POST /admin/accounts/:did/untakedown 676 676 + pub async fn untakedown_account( 677 677 + State(state): State<AppState>, 678 678 + Extension(session): Extension<AdminSession>, 679 679 + Extension(_permissions): Extension<AdminPermissions>, 680 680 + Path(did): Path<String>, 681 681 + ) -> Response { 682 682 + let rbac = match &state.admin_rbac_config { 683 683 + Some(r) => r, 684 684 + None => return StatusCode::NOT_FOUND.into_response(), 685 685 + }; 686 686 + 687 687 + if !rbac.can_access_endpoint(&session.did, "com.atproto.admin.updateSubjectStatus") { 688 688 + return flash_redirect( 689 689 + &format!("/admin/accounts/{}", did), 690 690 + None, 691 691 + Some("Access denied"), 692 692 + ); 693 693 + } 694 694 + 695 695 + let body = serde_json::json!({ 696 696 + "subject": { 697 697 + "$type": "com.atproto.admin.defs#repoRef", 698 698 + "did": did, 699 699 + }, 700 700 + "takedown": { 701 701 + "applied": false, 702 702 + }, 703 703 + }); 704 704 + 705 705 + match pds_proxy::admin_xrpc_post_no_response( 706 706 + pds_url(&state), 707 707 + admin_password(&state), 708 708 + "com.atproto.admin.updateSubjectStatus", 709 709 + &body, 710 710 + ) 711 711 + .await 712 712 + { 713 713 + Ok(()) => flash_redirect( 714 714 + &format!("/admin/accounts/{}", did), 715 715 + Some("Takedown removed successfully"), 716 716 + None, 717 717 + ), 718 718 + Err(e) => flash_redirect( 719 719 + &format!("/admin/accounts/{}", did), 720 720 + None, 721 721 + Some(&format!("Failed to remove takedown: {}", e)), 722 722 + ), 723 723 + } 724 724 + } 725 725 + 726 726 + /// POST /admin/accounts/:did/delete 727 727 + pub async fn delete_account( 728 728 + State(state): State<AppState>, 729 729 + Extension(session): Extension<AdminSession>, 730 730 + Extension(_permissions): Extension<AdminPermissions>, 731 731 + Path(did): Path<String>, 732 732 + ) -> Response { 733 733 + let rbac = match &state.admin_rbac_config { 734 734 + Some(r) => r, 735 735 + None => return StatusCode::NOT_FOUND.into_response(), 736 736 + }; 737 737 + 738 738 + if !rbac.can_access_endpoint(&session.did, "com.atproto.admin.deleteAccount") { 739 739 + return flash_redirect( 740 740 + &format!("/admin/accounts/{}", did), 741 741 + None, 742 742 + Some("Access denied: cannot delete accounts"), 743 743 + ); 744 744 + } 745 745 + 746 746 + let body = serde_json::json!({ "did": did }); 747 747 + 748 748 + match pds_proxy::admin_xrpc_post_no_response( 749 749 + pds_url(&state), 750 750 + admin_password(&state), 751 751 + "com.atproto.admin.deleteAccount", 752 752 + &body, 753 753 + ) 754 754 + .await 755 755 + { 756 756 + Ok(()) => flash_redirect( 757 757 + "/admin/accounts", 758 758 + Some(&format!("Account {} deleted", did)), 759 759 + None, 760 760 + ), 761 761 + Err(e) => flash_redirect( 762 762 + &format!("/admin/accounts/{}", did), 763 763 + None, 764 764 + Some(&format!("Delete failed: {}", e)), 765 765 + ), 766 766 + } 767 767 + } 768 768 + 769 769 + /// POST /admin/accounts/:did/reset-password 770 770 + pub async fn reset_password( 771 771 + State(state): State<AppState>, 772 772 + Extension(session): Extension<AdminSession>, 773 773 + Extension(_permissions): Extension<AdminPermissions>, 774 774 + Path(did): Path<String>, 775 775 + Query(_flash): Query<FlashParams>, 776 776 + ) -> Response { 777 777 + let rbac = match &state.admin_rbac_config { 778 778 + Some(r) => r, 779 779 + None => return StatusCode::NOT_FOUND.into_response(), 780 780 + }; 781 781 + 782 782 + if !rbac.can_access_endpoint(&session.did, "com.atproto.admin.updateAccountPassword") { 783 783 + return flash_redirect( 784 784 + &format!("/admin/accounts/{}", did), 785 785 + None, 786 786 + Some("Access denied: cannot reset passwords"), 787 787 + ); 788 788 + } 789 789 + 790 790 + let new_password = generate_random_password(); 791 791 + let body = serde_json::json!({ 792 792 + "did": did, 793 793 + "password": new_password, 794 794 + }); 795 795 + 796 796 + match pds_proxy::admin_xrpc_post_no_response( 797 797 + pds_url(&state), 798 798 + admin_password(&state), 799 799 + "com.atproto.admin.updateAccountPassword", 800 800 + &body, 801 801 + ) 802 802 + .await 803 803 + { 804 804 + Ok(()) => { 805 805 + // Bug 3 fix: redirect with new_password param so account_detail can display it 806 806 + let encoded = urlencoding::encode(&new_password); 807 807 + Redirect::to(&format!( 808 808 + "/admin/accounts/{}?flash_success=Password+reset+successfully&new_password={}", 809 809 + did, encoded 810 810 + )) 811 811 + .into_response() 812 812 + } 813 813 + Err(e) => flash_redirect( 814 814 + &format!("/admin/accounts/{}", did), 815 815 + None, 816 816 + Some(&format!("Password reset failed: {}", e)), 817 817 + ), 818 818 + } 819 819 + } 820 820 + 821 821 + /// POST /admin/accounts/:did/disable-invites 822 822 + pub async fn disable_account_invites( 823 823 + State(state): State<AppState>, 824 824 + Extension(session): Extension<AdminSession>, 825 825 + Extension(_permissions): Extension<AdminPermissions>, 826 826 + Path(did): Path<String>, 827 827 + ) -> Response { 828 828 + let rbac = match &state.admin_rbac_config { 829 829 + Some(r) => r, 830 830 + None => return StatusCode::NOT_FOUND.into_response(), 831 831 + }; 832 832 + 833 833 + if !rbac.can_access_endpoint(&session.did, "com.atproto.admin.disableAccountInvites") { 834 834 + return flash_redirect( 835 835 + &format!("/admin/accounts/{}", did), 836 836 + None, 837 837 + Some("Access denied"), 838 838 + ); 839 839 + } 840 840 + 841 841 + let body = serde_json::json!({ "account": did }); 842 842 + 843 843 + match pds_proxy::admin_xrpc_post_no_response( 844 844 + pds_url(&state), 845 845 + admin_password(&state), 846 846 + "com.atproto.admin.disableAccountInvites", 847 847 + &body, 848 848 + ) 849 849 + .await 850 850 + { 851 851 + Ok(()) => flash_redirect( 852 852 + &format!("/admin/accounts/{}", did), 853 853 + Some("Invites disabled"), 854 854 + None, 855 855 + ), 856 856 + Err(e) => flash_redirect( 857 857 + &format!("/admin/accounts/{}", did), 858 858 + None, 859 859 + Some(&format!("Failed: {}", e)), 860 860 + ), 861 861 + } 862 862 + } 863 863 + 864 864 + /// POST /admin/accounts/:did/enable-invites 865 865 + pub async fn enable_account_invites( 866 866 + State(state): State<AppState>, 867 867 + Extension(session): Extension<AdminSession>, 868 868 + Extension(_permissions): Extension<AdminPermissions>, 869 869 + Path(did): Path<String>, 870 870 + ) -> Response { 871 871 + let rbac = match &state.admin_rbac_config { 872 872 + Some(r) => r, 873 873 + None => return StatusCode::NOT_FOUND.into_response(), 874 874 + }; 875 875 + 876 876 + if !rbac.can_access_endpoint(&session.did, "com.atproto.admin.enableAccountInvites") { 877 877 + return flash_redirect( 878 878 + &format!("/admin/accounts/{}", did), 879 879 + None, 880 880 + Some("Access denied"), 881 881 + ); 882 882 + } 883 883 + 884 884 + let body = serde_json::json!({ "account": did }); 885 885 + 886 886 + match pds_proxy::admin_xrpc_post_no_response( 887 887 + pds_url(&state), 888 888 + admin_password(&state), 889 889 + "com.atproto.admin.enableAccountInvites", 890 890 + &body, 891 891 + ) 892 892 + .await 893 893 + { 894 894 + Ok(()) => flash_redirect( 895 895 + &format!("/admin/accounts/{}", did), 896 896 + Some("Invites enabled"), 897 897 + None, 898 898 + ), 899 899 + Err(e) => flash_redirect( 900 900 + &format!("/admin/accounts/{}", did), 901 901 + None, 902 902 + Some(&format!("Failed: {}", e)), 903 903 + ), 904 904 + } 905 905 + } 906 906 + 907 907 + /// GET /admin/invite-codes — List invite codes (with pagination) 908 908 + pub async fn invite_codes_list( 909 909 + State(state): State<AppState>, 910 910 + Extension(session): Extension<AdminSession>, 911 911 + Extension(permissions): Extension<AdminPermissions>, 912 912 + Query(params): Query<InviteCodesParams>, 913 913 + ) -> Response { 914 914 + let rbac = match &state.admin_rbac_config { 915 915 + Some(r) => r, 916 916 + None => return StatusCode::NOT_FOUND.into_response(), 917 917 + }; 918 918 + 919 919 + if !rbac.can_access_endpoint(&session.did, "com.atproto.admin.getInviteCodes") { 920 920 + return flash_redirect("/admin/dashboard", None, Some("Access denied")); 921 921 + } 922 922 + 923 923 + // Phase 4: pagination support with cursor 924 924 + let mut query_params = vec![("limit", "100"), ("sort", "recent")]; 925 925 + let cursor_val; 926 926 + if let Some(ref c) = params.cursor { 927 927 + cursor_val = c.clone(); 928 928 + query_params.push(("cursor", &cursor_val)); 929 929 + } 930 930 + 931 931 + let response = pds_proxy::admin_xrpc_get::<serde_json::Value>( 932 932 + pds_url(&state), 933 933 + admin_password(&state), 934 934 + "com.atproto.admin.getInviteCodes", 935 935 + &query_params, 936 936 + ) 937 937 + .await; 938 938 + 939 939 + let (codes_raw, next_cursor) = match response { 940 940 + Ok(res) => { 941 941 + let codes = res["codes"].clone(); 942 942 + let cursor = res["cursor"].as_str().map(|s| s.to_string()); 943 943 + (codes, cursor) 944 944 + } 945 945 + Err(e) => { 946 946 + tracing::error!("Failed to get invite codes: {}", e); 947 947 + (serde_json::json!([]), None) 948 948 + } 949 949 + }; 950 950 + 951 951 + // Bug 5 fix: post-process codes to compute used_count and remaining 952 952 + let codes = if let Some(arr) = codes_raw.as_array() { 953 953 + let processed: Vec<serde_json::Value> = arr 954 954 + .iter() 955 955 + .map(|code| { 956 956 + let mut c = code.clone(); 957 957 + let available = c["available"].as_i64().unwrap_or(0); 958 958 + let used_count = c["uses"].as_array().map(|u| u.len() as i64).unwrap_or(0); 959 959 + let remaining = (available - used_count).max(0); 960 960 + c["used_count"] = used_count.into(); 961 961 + c["remaining"] = remaining.into(); 962 962 + c 963 963 + }) 964 964 + .collect(); 965 965 + serde_json::json!(processed) 966 966 + } else { 967 967 + serde_json::json!([]) 968 968 + }; 969 969 + 970 970 + let mut data = serde_json::json!({ 971 971 + "codes": codes, 972 972 + "pds_hostname": state.app_config.pds_hostname, 973 973 + "active_page": "invite_codes", 974 974 + }); 975 975 + 976 976 + // Phase 4: pagination 977 977 + if let Some(cursor) = next_cursor { 978 978 + data["next_cursor"] = cursor.into(); 979 979 + data["has_more"] = true.into(); 980 980 + } 981 981 + 982 982 + if let Some(msg) = params.flash_success { 983 983 + data["flash_success"] = msg.into(); 984 984 + } 985 985 + if let Some(msg) = params.flash_error { 986 986 + data["flash_error"] = msg.into(); 987 987 + } 988 988 + 989 989 + inject_nav_data(&mut data, &session, &permissions); 990 990 + 991 991 + render_template(&state, "admin/invite_codes.hbs", data) 992 992 + } 993 993 + 994 994 + /// POST /admin/invite-codes/create 995 995 + pub async fn create_invite_code( 996 996 + State(state): State<AppState>, 997 997 + Extension(session): Extension<AdminSession>, 998 998 + Extension(_permissions): Extension<AdminPermissions>, 999 999 + axum::extract::Form(form): axum::extract::Form<CreateInviteForm>, 1000 1000 + ) -> Response { 1001 1001 + let rbac = match &state.admin_rbac_config { 1002 1002 + Some(r) => r, 1003 1003 + None => return StatusCode::NOT_FOUND.into_response(), 1004 1004 + }; 1005 1005 + 1006 1006 + if !rbac.can_access_endpoint(&session.did, "com.atproto.server.createInviteCode") { 1007 1007 + return flash_redirect("/admin/invite-codes", None, Some("Access denied")); 1008 1008 + } 1009 1009 + 1010 1010 + let use_count = form.use_count.unwrap_or(1).max(1); 1011 1011 + let body = serde_json::json!({ "useCount": use_count }); 1012 1012 + 1013 1013 + match pds_proxy::admin_xrpc_post::<_, serde_json::Value>( 1014 1014 + pds_url(&state), 1015 1015 + admin_password(&state), 1016 1016 + "com.atproto.server.createInviteCode", 1017 1017 + &body, 1018 1018 + ) 1019 1019 + .await 1020 1020 + { 1021 1021 + Ok(res) => { 1022 1022 + let code = res["code"].as_str().unwrap_or("unknown"); 1023 1023 + flash_redirect( 1024 1024 + "/admin/invite-codes", 1025 1025 + Some(&format!("Invite code created: {}", code)), 1026 1026 + None, 1027 1027 + ) 1028 1028 + } 1029 1029 + Err(e) => flash_redirect( 1030 1030 + "/admin/invite-codes", 1031 1031 + None, 1032 1032 + Some(&format!("Failed to create invite code: {}", e)), 1033 1033 + ), 1034 1034 + } 1035 1035 + } 1036 1036 + 1037 1037 + /// POST /admin/invite-codes/disable 1038 1038 + pub async fn disable_invite_codes( 1039 1039 + State(state): State<AppState>, 1040 1040 + Extension(session): Extension<AdminSession>, 1041 1041 + Extension(_permissions): Extension<AdminPermissions>, 1042 1042 + axum::extract::Form(form): axum::extract::Form<DisableInviteCodesForm>, 1043 1043 + ) -> Response { 1044 1044 + let rbac = match &state.admin_rbac_config { 1045 1045 + Some(r) => r, 1046 1046 + None => return StatusCode::NOT_FOUND.into_response(), 1047 1047 + }; 1048 1048 + 1049 1049 + if !rbac.can_access_endpoint(&session.did, "com.atproto.admin.disableInviteCodes") { 1050 1050 + return flash_redirect("/admin/invite-codes", None, Some("Access denied")); 1051 1051 + } 1052 1052 + 1053 1053 + let codes: Vec<String> = form 1054 1054 + .codes 1055 1055 + .split(',') 1056 1056 + .map(|s| s.trim().to_string()) 1057 1057 + .filter(|s| !s.is_empty()) 1058 1058 + .collect(); 1059 1059 + 1060 1060 + let body = serde_json::json!({ 1061 1061 + "codes": codes, 1062 1062 + "accounts": [], 1063 1063 + }); 1064 1064 + 1065 1065 + match pds_proxy::admin_xrpc_post_no_response( 1066 1066 + pds_url(&state), 1067 1067 + admin_password(&state), 1068 1068 + "com.atproto.admin.disableInviteCodes", 1069 1069 + &body, 1070 1070 + ) 1071 1071 + .await 1072 1072 + { 1073 1073 + Ok(()) => flash_redirect("/admin/invite-codes", Some("Invite codes disabled"), None), 1074 1074 + Err(e) => flash_redirect("/admin/invite-codes", None, Some(&format!("Failed: {}", e))), 1075 1075 + } 1076 1076 + } 1077 1077 + 1078 1078 + /// GET /admin/create-account — Form 1079 1079 + pub async fn get_create_account( 1080 1080 + State(state): State<AppState>, 1081 1081 + Extension(session): Extension<AdminSession>, 1082 1082 + Extension(permissions): Extension<AdminPermissions>, 1083 1083 + Query(flash): Query<FlashParams>, 1084 1084 + ) -> Response { 1085 1085 + let rbac = match &state.admin_rbac_config { 1086 1086 + Some(r) => r, 1087 1087 + None => return StatusCode::NOT_FOUND.into_response(), 1088 1088 + }; 1089 1089 + 1090 1090 + if !rbac.can_access_endpoint(&session.did, "com.atproto.server.createAccount") { 1091 1091 + return flash_redirect("/admin/dashboard", None, Some("Access denied")); 1092 1092 + } 1093 1093 + 1094 1094 + let mut data = serde_json::json!({ 1095 1095 + "pds_hostname": state.app_config.pds_hostname, 1096 1096 + "active_page": "create_account", 1097 1097 + }); 1098 1098 + 1099 1099 + if let Some(msg) = flash.flash_success { 1100 1100 + data["flash_success"] = msg.into(); 1101 1101 + } 1102 1102 + if let Some(msg) = flash.flash_error { 1103 1103 + data["flash_error"] = msg.into(); 1104 1104 + } 1105 1105 + 1106 1106 + inject_nav_data(&mut data, &session, &permissions); 1107 1107 + 1108 1108 + render_template(&state, "admin/create_account.hbs", data) 1109 1109 + } 1110 1110 + 1111 1111 + /// POST /admin/create-account — Create account 1112 1112 + pub async fn post_create_account( 1113 1113 + State(state): State<AppState>, 1114 1114 + Extension(session): Extension<AdminSession>, 1115 1115 + Extension(permissions): Extension<AdminPermissions>, 1116 1116 + axum::extract::Form(form): axum::extract::Form<CreateAccountForm>, 1117 1117 + ) -> Response { 1118 1118 + let rbac = match &state.admin_rbac_config { 1119 1119 + Some(r) => r, 1120 1120 + None => return StatusCode::NOT_FOUND.into_response(), 1121 1121 + }; 1122 1122 + 1123 1123 + if !rbac.can_access_endpoint(&session.did, "com.atproto.server.createAccount") { 1124 1124 + return flash_redirect("/admin/create-account", None, Some("Access denied")); 1125 1125 + } 1126 1126 + 1127 1127 + let pds = pds_url(&state); 1128 1128 + let password_str = admin_password(&state); 1129 1129 + 1130 1130 + // Step 1: Create invite code 1131 1131 + let invite_body = serde_json::json!({ "useCount": 1 }); 1132 1132 + let invite_res = match pds_proxy::admin_xrpc_post::<_, serde_json::Value>( 1133 1133 + pds, 1134 1134 + password_str, 1135 1135 + "com.atproto.server.createInviteCode", 1136 1136 + &invite_body, 1137 1137 + ) 1138 1138 + .await 1139 1139 + { 1140 1140 + Ok(res) => res, 1141 1141 + Err(e) => { 1142 1142 + return flash_redirect( 1143 1143 + "/admin/create-account", 1144 1144 + None, 1145 1145 + Some(&format!("Failed to create invite code: {}", e)), 1146 1146 + ); 1147 1147 + } 1148 1148 + }; 1149 1149 + 1150 1150 + let invite_code = invite_res["code"].as_str().unwrap_or("").to_string(); 1151 1151 + 1152 1152 + // Step 2: Create account 1153 1153 + let account_password = generate_random_password(); 1154 1154 + let account_body = serde_json::json!({ 1155 1155 + "email": form.email, 1156 1156 + "handle": form.handle, 1157 1157 + "password": account_password, 1158 1158 + "inviteCode": invite_code, 1159 1159 + }); 1160 1160 + 1161 1161 + match pds_proxy::admin_xrpc_post::<_, serde_json::Value>( 1162 1162 + pds, 1163 1163 + password_str, 1164 1164 + "com.atproto.server.createAccount", 1165 1165 + &account_body, 1166 1166 + ) 1167 1167 + .await 1168 1168 + { 1169 1169 + Ok(res) => { 1170 1170 + // Bug 4 fix: nest data under "created" object so template can use 1171 1171 + // {{created.did}}, {{created.handle}}, etc. 1172 1172 + let mut data = serde_json::json!({ 1173 1173 + "pds_hostname": state.app_config.pds_hostname, 1174 1174 + "active_page": "create_account", 1175 1175 + "created": { 1176 1176 + "did": res["did"].as_str().unwrap_or(""), 1177 1177 + "handle": res["handle"].as_str().unwrap_or(""), 1178 1178 + "email": form.email, 1179 1179 + "password": account_password, 1180 1180 + "inviteCode": invite_code, 1181 1181 + }, 1182 1182 + }); 1183 1183 + 1184 1184 + inject_nav_data(&mut data, &session, &permissions); 1185 1185 + 1186 1186 + render_template(&state, "admin/create_account.hbs", data) 1187 1187 + } 1188 1188 + Err(e) => flash_redirect( 1189 1189 + "/admin/create-account", 1190 1190 + None, 1191 1191 + Some(&format!("Failed to create account: {}", e)), 1192 1192 + ), 1193 1193 + } 1194 1194 + } 1195 1195 + 1196 1196 + /// GET /admin/request-crawl — Request Crawl form (Gap 3) 1197 1197 + pub async fn get_request_crawl( 1198 1198 + State(state): State<AppState>, 1199 1199 + Extension(session): Extension<AdminSession>, 1200 1200 + Extension(permissions): Extension<AdminPermissions>, 1201 1201 + Query(flash): Query<FlashParams>, 1202 1202 + ) -> Response { 1203 1203 + if !permissions.can_request_crawl { 1204 1204 + return flash_redirect("/admin/dashboard", None, Some("Access denied")); 1205 1205 + } 1206 1206 + 1207 1207 + let mut data = serde_json::json!({ 1208 1208 + "pds_hostname": state.app_config.pds_hostname, 1209 1209 + "active_page": "request_crawl", 1210 1210 + "default_relay": "bsky.network", 1211 1211 + }); 1212 1212 + 1213 1213 + if let Some(msg) = flash.flash_success { 1214 1214 + data["flash_success"] = msg.into(); 1215 1215 + } 1216 1216 + if let Some(msg) = flash.flash_error { 1217 1217 + data["flash_error"] = msg.into(); 1218 1218 + } 1219 1219 + 1220 1220 + inject_nav_data(&mut data, &session, &permissions); 1221 1221 + 1222 1222 + render_template(&state, "admin/request_crawl.hbs", data) 1223 1223 + } 1224 1224 + 1225 1225 + /// POST /admin/request-crawl — Submit crawl request to relay (Gap 3) 1226 1226 + pub async fn post_request_crawl( 1227 1227 + State(state): State<AppState>, 1228 1228 + Extension(session): Extension<AdminSession>, 1229 1229 + Extension(_permissions): Extension<AdminPermissions>, 1230 1230 + axum::extract::Form(form): axum::extract::Form<RequestCrawlForm>, 1231 1231 + ) -> Response { 1232 1232 + let rbac = match &state.admin_rbac_config { 1233 1233 + Some(r) => r, 1234 1234 + None => return StatusCode::NOT_FOUND.into_response(), 1235 1235 + }; 1236 1236 + 1237 1237 + if !rbac.can_access_endpoint(&session.did, "com.atproto.sync.requestCrawl") { 1238 1238 + return flash_redirect("/admin/request-crawl", None, Some("Access denied")); 1239 1239 + } 1240 1240 + 1241 1241 + let relay_base = format!("https://{}", form.relay_host.trim_end_matches('/')); 1242 1242 + let pds_hostname = &state.app_config.pds_hostname; 1243 1243 + 1244 1244 + let body = serde_json::json!({ 1245 1245 + "hostname": pds_hostname, 1246 1246 + }); 1247 1247 + 1248 1248 + match pds_proxy::public_xrpc_post(&relay_base, "com.atproto.sync.requestCrawl", &body).await { 1249 1249 + Ok(()) => flash_redirect( 1250 1250 + "/admin/request-crawl", 1251 1251 + Some(&format!( 1252 1252 + "Crawl requested from {} for {}", 1253 1253 + form.relay_host, pds_hostname 1254 1254 + )), 1255 1255 + None, 1256 1256 + ), 1257 1257 + Err(e) => flash_redirect( 1258 1258 + "/admin/request-crawl", 1259 1259 + None, 1260 1260 + Some(&format!("Request crawl failed: {}", e)), 1261 1261 + ), 1262 1262 + } 1263 1263 + } 1264 1264 + 1265 1265 + /// POST /admin/logout — Clear session and redirect to login 1266 1266 + pub async fn logout(State(state): State<AppState>, jar: SignedCookieJar) -> Response { 1267 1267 + if let Some(cookie) = jar.get("__gatekeeper_admin_session") { 1268 1268 + let session_id = cookie.value().to_string(); 1269 1269 + let _ = session::delete_session(&state.pds_gatekeeper_pool, &session_id).await; 1270 1270 + } 1271 1271 + 1272 1272 + let mut removal = Cookie::build("__gatekeeper_admin_session") 1273 1273 + .path("/admin/dashboard") 1274 1274 + .build(); 1275 1275 + removal.make_removal(); 1276 1276 + 1277 1277 + let updated_jar = jar.remove(removal); 1278 1278 + 1279 1279 + (updated_jar, Redirect::to("/admin/login")).into_response() 1280 1280 + }

+79

src/admin/session.rs

··· 1 1 + use anyhow::Result; 2 2 + use chrono::Utc; 3 3 + use sqlx::SqlitePool; 4 4 + use uuid::Uuid; 5 5 + 6 6 + #[derive(Debug, Clone, sqlx::FromRow)] 7 7 + pub struct AdminSessionRow { 8 8 + pub session_id: String, 9 9 + pub did: String, 10 10 + pub handle: String, 11 11 + pub created_at: String, 12 12 + pub expires_at: String, 13 13 + } 14 14 + 15 15 + /// Creates a new admin session and returns the generated session_id. 16 16 + pub async fn create_session( 17 17 + pool: &SqlitePool, 18 18 + did: &str, 19 19 + handle: &str, 20 20 + ttl_hours: u64, 21 21 + ) -> Result<String> { 22 22 + let session_id = Uuid::new_v4().to_string(); 23 23 + let now = Utc::now(); 24 24 + let created_at = now.to_rfc3339(); 25 25 + let expires_at = (now + chrono::Duration::hours(ttl_hours as i64)).to_rfc3339(); 26 26 + 27 27 + sqlx::query( 28 28 + "INSERT INTO admin_sessions (session_id, did, handle, created_at, expires_at) VALUES (?, ?, ?, ?, ?)", 29 29 + ) 30 30 + .bind(&session_id) 31 31 + .bind(did) 32 32 + .bind(handle) 33 33 + .bind(&created_at) 34 34 + .bind(&expires_at) 35 35 + .execute(pool) 36 36 + .await?; 37 37 + 38 38 + Ok(session_id) 39 39 + } 40 40 + 41 41 + /// Looks up a session by ID. Returns None if the session does not exist or has expired. 42 42 + pub async fn get_session( 43 43 + pool: &SqlitePool, 44 44 + session_id: &str, 45 45 + ) -> Result<Option<AdminSessionRow>> { 46 46 + let now = Utc::now().to_rfc3339(); 47 47 + 48 48 + let row = sqlx::query_as::<_, AdminSessionRow>( 49 49 + "SELECT session_id, did, handle, created_at, expires_at FROM admin_sessions WHERE session_id = ? AND expires_at > ?", 50 50 + ) 51 51 + .bind(session_id) 52 52 + .bind(&now) 53 53 + .fetch_optional(pool) 54 54 + .await?; 55 55 + 56 56 + Ok(row) 57 57 + } 58 58 + 59 59 + /// Deletes a session by ID. 60 60 + pub async fn delete_session(pool: &SqlitePool, session_id: &str) -> Result<()> { 61 61 + sqlx::query("DELETE FROM admin_sessions WHERE session_id = ?") 62 62 + .bind(session_id) 63 63 + .execute(pool) 64 64 + .await?; 65 65 + 66 66 + Ok(()) 67 67 + } 68 68 + 69 69 + /// Deletes all expired sessions and returns the number of rows removed. 70 70 + pub async fn cleanup_expired_sessions(pool: &SqlitePool) -> Result<u64> { 71 71 + let now = Utc::now().to_rfc3339(); 72 72 + 73 73 + let result = sqlx::query("DELETE FROM admin_sessions WHERE expires_at <= ?") 74 74 + .bind(&now) 75 75 + .execute(pool) 76 76 + .await?; 77 77 + 78 78 + Ok(result.rows_affected()) 79 79 + }

+45

src/admin/static_files.rs

··· 1 1 + use axum::{ 2 2 + extract::Path, 3 3 + http::{StatusCode, header}, 4 4 + response::{IntoResponse, Response}, 5 5 + }; 6 6 + 7 7 + use crate::StaticFiles; 8 8 + 9 9 + /// Serve embedded static files at /admin/static/*path 10 10 + pub async fn serve_static(Path(path): Path<String>) -> Response { 11 11 + let file = match StaticFiles::get(&path) { 12 12 + Some(file) => file, 13 13 + None => return StatusCode::NOT_FOUND.into_response(), 14 14 + }; 15 15 + 16 16 + let mime_type = mime_from_path(&path); 17 17 + 18 18 + ( 19 19 + [ 20 20 + (header::CONTENT_TYPE, mime_type), 21 21 + (header::CACHE_CONTROL, cache_control_value()), 22 22 + ], 23 23 + file.data.to_vec(), 24 24 + ) 25 25 + .into_response() 26 26 + } 27 27 + 28 28 + fn mime_from_path(path: &str) -> &'static str { 29 29 + match path.rsplit('.').next() { 30 30 + Some("css") => "text/css; charset=utf-8", 31 31 + Some("js") => "application/javascript; charset=utf-8", 32 32 + Some("svg") => "image/svg+xml", 33 33 + Some("png") => "image/png", 34 34 + Some("jpg") | Some("jpeg") => "image/jpeg", 35 35 + _ => "application/octet-stream", 36 36 + } 37 37 + } 38 38 + 39 39 + fn cache_control_value() -> &'static str { 40 40 + if cfg!(debug_assertions) { 41 41 + "no-cache" 42 42 + } else { 43 43 + "public, max-age=3600, stale-while-revalidate=86400" 44 44 + } 45 45 + }

+154

src/admin/store.rs

··· 1 1 + use jacquard_common::IntoStatic; 2 2 + use jacquard_common::session::SessionStoreError; 3 3 + use jacquard_common::types::did::Did; 4 4 + use jacquard_oauth::authstore::ClientAuthStore; 5 5 + use jacquard_oauth::session::{AuthRequestData, ClientSessionData}; 6 6 + use sqlx::SqlitePool; 7 7 + 8 8 + fn sqlx_to_session_err(e: sqlx::Error) -> SessionStoreError { 9 9 + SessionStoreError::Other(Box::new(e)) 10 10 + } 11 11 + 12 12 + #[derive(Clone)] 13 13 + pub struct SqlAuthStore { 14 14 + pool: SqlitePool, 15 15 + } 16 16 + 17 17 + impl SqlAuthStore { 18 18 + pub fn new(pool: SqlitePool) -> Self { 19 19 + Self { pool } 20 20 + } 21 21 + } 22 22 + 23 23 + impl ClientAuthStore for SqlAuthStore { 24 24 + async fn get_session( 25 25 + &self, 26 26 + did: &Did<'_>, 27 27 + session_id: &str, 28 28 + ) -> Result<Option<ClientSessionData<'_>>, SessionStoreError> { 29 29 + let key = format!("{}_{}", did, session_id); 30 30 + 31 31 + let row: Option<(String,)> = 32 32 + sqlx::query_as("SELECT data FROM oauth_client_sessions WHERE session_key = ?") 33 33 + .bind(&key) 34 34 + .fetch_optional(&self.pool) 35 35 + .await 36 36 + .map_err(sqlx_to_session_err)?; 37 37 + 38 38 + match row { 39 39 + Some((json_data,)) => { 40 40 + let session: ClientSessionData<'_> = serde_json::from_str(&json_data)?; 41 41 + Ok(Some(session.into_static())) 42 42 + } 43 43 + None => Ok(None), 44 44 + } 45 45 + } 46 46 + 47 47 + async fn upsert_session( 48 48 + &self, 49 49 + session: ClientSessionData<'_>, 50 50 + ) -> Result<(), SessionStoreError> { 51 51 + let static_session = session.into_static(); 52 52 + let did = static_session.account_did.to_string(); 53 53 + let session_id = static_session.session_id.to_string(); 54 54 + let key = format!("{}_{}", did, session_id); 55 55 + let json_data = serde_json::to_string(&static_session)?; 56 56 + let now = chrono::Utc::now().to_rfc3339(); 57 57 + 58 58 + sqlx::query( 59 59 + "INSERT INTO oauth_client_sessions (session_key, did, session_id, data, created_at, updated_at) 60 60 + VALUES (?, ?, ?, ?, ?, ?) 61 61 + ON CONFLICT(session_key) DO UPDATE SET data = excluded.data, updated_at = excluded.updated_at", 62 62 + ) 63 63 + .bind(&key) 64 64 + .bind(&did) 65 65 + .bind(&session_id) 66 66 + .bind(&json_data) 67 67 + .bind(&now) 68 68 + .bind(&now) 69 69 + .execute(&self.pool) 70 70 + .await 71 71 + .map_err(sqlx_to_session_err)?; 72 72 + 73 73 + Ok(()) 74 74 + } 75 75 + 76 76 + async fn delete_session( 77 77 + &self, 78 78 + did: &Did<'_>, 79 79 + session_id: &str, 80 80 + ) -> Result<(), SessionStoreError> { 81 81 + let key = format!("{}_{}", did, session_id); 82 82 + 83 83 + sqlx::query("DELETE FROM oauth_client_sessions WHERE session_key = ?") 84 84 + .bind(&key) 85 85 + .execute(&self.pool) 86 86 + .await 87 87 + .map_err(sqlx_to_session_err)?; 88 88 + 89 89 + Ok(()) 90 90 + } 91 91 + 92 92 + async fn get_auth_req_info( 93 93 + &self, 94 94 + state: &str, 95 95 + ) -> Result<Option<AuthRequestData<'_>>, SessionStoreError> { 96 96 + let row: Option<(String,)> = 97 97 + sqlx::query_as("SELECT data FROM oauth_auth_requests WHERE state = ?") 98 98 + .bind(state) 99 99 + .fetch_optional(&self.pool) 100 100 + .await 101 101 + .map_err(sqlx_to_session_err)?; 102 102 + 103 103 + match row { 104 104 + Some((json_data,)) => { 105 105 + let auth_req: AuthRequestData<'_> = serde_json::from_str(&json_data)?; 106 106 + Ok(Some(auth_req.into_static())) 107 107 + } 108 108 + None => Ok(None), 109 109 + } 110 110 + } 111 111 + 112 112 + async fn save_auth_req_info( 113 113 + &self, 114 114 + auth_req_info: &AuthRequestData<'_>, 115 115 + ) -> Result<(), SessionStoreError> { 116 116 + let static_info = auth_req_info.clone().into_static(); 117 117 + let state = static_info.state.to_string(); 118 118 + let json_data = serde_json::to_string(&static_info)?; 119 119 + let now = chrono::Utc::now().to_rfc3339(); 120 120 + 121 121 + sqlx::query("INSERT INTO oauth_auth_requests (state, data, created_at) VALUES (?, ?, ?)") 122 122 + .bind(&state) 123 123 + .bind(&json_data) 124 124 + .bind(&now) 125 125 + .execute(&self.pool) 126 126 + .await 127 127 + .map_err(sqlx_to_session_err)?; 128 128 + 129 129 + Ok(()) 130 130 + } 131 131 + 132 132 + async fn delete_auth_req_info(&self, state: &str) -> Result<(), SessionStoreError> { 133 133 + sqlx::query("DELETE FROM oauth_auth_requests WHERE state = ?") 134 134 + .bind(state) 135 135 + .execute(&self.pool) 136 136 + .await 137 137 + .map_err(sqlx_to_session_err)?; 138 138 + 139 139 + Ok(()) 140 140 + } 141 141 + } 142 142 + 143 143 + /// Delete auth requests older than the given number of minutes. 144 144 + pub async fn cleanup_stale_auth_requests( 145 145 + pool: &SqlitePool, 146 146 + max_age_minutes: i64, 147 147 + ) -> Result<u64, sqlx::Error> { 148 148 + let cutoff = (chrono::Utc::now() - chrono::Duration::minutes(max_age_minutes)).to_rfc3339(); 149 149 + let result = sqlx::query("DELETE FROM oauth_auth_requests WHERE created_at < ?") 150 150 + .bind(&cutoff) 151 151 + .execute(pool) 152 152 + .await?; 153 153 + Ok(result.rows_affected()) 154 154 + }

+118 -1

src/main.rs

··· 41 41 use tracing::{Span, log}; 42 42 use tracing_subscriber::{EnvFilter, fmt, prelude::*}; 43 43 44 44 + mod admin; 44 45 mod auth; 45 46 mod gate; 46 47 pub mod helpers; ··· 60 61 #[folder = "html_templates"] 61 62 #[include = "*.hbs"] 62 63 struct HtmlTemplates; 64 64 + 65 65 + #[derive(RustEmbed)] 66 66 + #[folder = "static"] 67 67 + pub struct StaticFiles; 63 68 64 69 /// Mostly the env variables that are used in the app 65 70 #[derive(Clone, Debug)] ··· 75 80 pds_service_did: Did<'static>, 76 81 gate_jwe_key: Vec<u8>, 77 82 captcha_success_redirects: Vec<String>, 83 83 + // Admin portal config 84 84 + pub pds_admin_password: Option<String>, 85 85 + pub pds_hostname: String, 86 86 + pub admin_session_ttl_hours: u64, 78 87 } 79 88 80 89 impl AppConfig { ··· 134 143 } 135 144 }; 136 145 146 146 + let pds_hostname = env::var("PDS_HOSTNAME").unwrap_or_else(|_| "localhost".to_string()); 147 147 + 148 148 + let pds_admin_password = env::var("PDS_ADMIN_PASSWORD").ok(); 149 149 + 150 150 + let admin_session_ttl_hours = env::var("GATEKEEPER_ADMIN_SESSION_TTL_HOURS") 151 151 + .ok() 152 152 + .and_then(|v| v.parse().ok()) 153 153 + .unwrap_or(24u64); 154 154 + 137 155 AppConfig { 138 156 pds_base_url, 139 157 mailer_from, ··· 147 165 .expect("PDS_SERVICE_DID is not a valid did or could not infer from PDS_HOSTNAME"), 148 166 gate_jwe_key, 149 167 captcha_success_redirects, 168 168 + pds_admin_password, 169 169 + pds_hostname, 170 170 + admin_session_ttl_hours, 150 171 } 151 172 } 152 173 } ··· 161 182 resolver: Arc<PublicResolver>, 162 183 handle_cache: auth::HandleCache, 163 184 app_config: AppConfig, 185 185 + // Admin portal 186 186 + admin_rbac_config: Option<Arc<admin::rbac::RbacConfig>>, 187 187 + admin_oauth_client: Option<Arc<admin::oauth::AdminOAuthClient>>, 188 188 + cookie_key: axum_extra::extract::cookie::Key, 189 189 + } 190 190 + 191 191 + impl axum::extract::FromRef<AppState> for axum_extra::extract::cookie::Key { 192 192 + fn from_ref(state: &AppState) -> Self { 193 193 + state.cookie_key.clone() 194 194 + } 164 195 } 165 196 166 197 async fn root_handler() -> impl axum::response::IntoResponse { ··· 277 308 let mut resolver = PublicResolver::default(); 278 309 resolver = resolver.with_plc_source(plc_source.clone()); 279 310 311 311 + let app_config = AppConfig::new(); 312 312 + 313 313 + // Admin portal setup (opt-in via GATEKEEPER_ADMIN_RBAC_CONFIG) 314 314 + let admin_rbac_config = env::var("GATEKEEPER_ADMIN_RBAC_CONFIG").ok().map(|path| { 315 315 + let config = admin::rbac::RbacConfig::load_from_file(&path) 316 316 + .unwrap_or_else(|e| panic!("Failed to load RBAC config from {}: {}", path, e)); 317 317 + log::info!( 318 318 + "Loaded admin RBAC config from {} ({} members)", 319 319 + path, 320 320 + config.members.len() 321 321 + ); 322 322 + Arc::new(config) 323 323 + }); 324 324 + 325 325 + let admin_oauth_client = if admin_rbac_config.is_some() { 326 326 + match admin::oauth::init_oauth_client(&app_config.pds_hostname, pds_gatekeeper_pool.clone()) 327 327 + { 328 328 + Ok(client) => { 329 329 + log::info!( 330 330 + "Admin OAuth client initialized for {}", 331 331 + app_config.pds_hostname 332 332 + ); 333 333 + Some(Arc::new(client)) 334 334 + } 335 335 + Err(e) => { 336 336 + log::error!( 337 337 + "Failed to initialize admin OAuth client: {}. Admin portal will be disabled.", 338 338 + e 339 339 + ); 340 340 + None 341 341 + } 342 342 + } 343 343 + } else { 344 344 + None 345 345 + }; 346 346 + 347 347 + // Cookie signing key for admin sessions 348 348 + let cookie_key = env::var("GATEKEEPER_ADMIN_COOKIE_SECRET") 349 349 + .ok() 350 350 + .and_then(|hex_str| hex::decode(hex_str).ok()) 351 351 + .unwrap_or_else(|| app_config.gate_jwe_key.clone()); 352 352 + let cookie_key = { 353 353 + // Key::from requires at least 64 bytes; derive by repeating if needed 354 354 + let mut key_bytes = cookie_key.clone(); 355 355 + while key_bytes.len() < 64 { 356 356 + key_bytes.extend_from_slice(&cookie_key); 357 357 + } 358 358 + axum_extra::extract::cookie::Key::from(&key_bytes[..64]) 359 359 + }; 360 360 + 280 361 let state = AppState { 281 362 account_pool, 282 363 pds_gatekeeper_pool, ··· 285 366 template_engine: Engine::from(hbs), 286 367 resolver: Arc::new(resolver), 287 368 handle_cache: auth::HandleCache::new(), 288 288 - app_config: AppConfig::new(), 369 369 + app_config, 370 370 + admin_rbac_config, 371 371 + admin_oauth_client, 372 372 + cookie_key, 289 373 }; 290 374 291 375 // Rate limiting ··· 387 471 "/gate/signup", 388 472 get(get_gate).post(post_gate.layer(GovernorLayer::new(captcha_governor_conf))), 389 473 ); 474 474 + } 475 475 + 476 476 + // Mount admin portal if RBAC config is loaded 477 477 + if state.admin_rbac_config.is_some() { 478 478 + let admin_router = admin::router(state.clone()); 479 479 + app = app.nest("/admin", admin_router); 480 480 + log::info!("Admin portal mounted at /admin/"); 481 481 + } 482 482 + 483 483 + // Background cleanup for admin sessions 484 484 + let admin_enabled = state.admin_rbac_config.is_some(); 485 485 + if admin_enabled { 486 486 + let admin_session_ttl_in_mins = state.app_config.admin_session_ttl_hours * 60; 487 487 + let cleanup_pool = state.pds_gatekeeper_pool.clone(); 488 488 + tokio::spawn(async move { 489 489 + let mut interval = tokio::time::interval(Duration::from_secs(300)); 490 490 + loop { 491 491 + interval.tick().await; 492 492 + if admin_enabled { 493 493 + if let Err(e) = admin::session::cleanup_expired_sessions(&cleanup_pool).await { 494 494 + tracing::error!("Failed to cleanup expired admin sessions: {}", e); 495 495 + } 496 496 + if let Err(e) = admin::store::cleanup_stale_auth_requests( 497 497 + &cleanup_pool, 498 498 + admin_session_ttl_in_mins as i64, 499 499 + ) 500 500 + .await 501 501 + { 502 502 + tracing::error!("Failed to cleanup stale OAuth auth requests: {}", e); 503 503 + } 504 504 + } 505 505 + } 506 506 + }); 390 507 } 391 508 392 509 let request_logging = env::var("GATEKEEPER_REQUEST_LOGGING")

+991

static/css/admin.css

··· 1 1 + :root, 2 2 + :root.light-mode { 3 3 + --brand-color: rgb(16, 131, 254); 4 4 + --primary-color: rgb(7, 10, 13); 5 5 + --secondary-color: rgb(66, 86, 108); 6 6 + --bg-primary-color: rgb(255, 255, 255); 7 7 + --bg-secondary-color: rgb(240, 242, 245); 8 8 + --border-color: rgb(220, 225, 230); 9 9 + --danger-color: rgb(220, 38, 38); 10 10 + --success-color: rgb(22, 163, 74); 11 11 + --warning-color: rgb(234, 179, 8); 12 12 + --table-stripe: rgba(0, 0, 0, 0.02); 13 13 + } 14 14 + 15 15 + @media (prefers-color-scheme: dark) { 16 16 + :root { 17 17 + --brand-color: rgb(16, 131, 254); 18 18 + --primary-color: rgb(255, 255, 255); 19 19 + --secondary-color: rgb(133, 152, 173); 20 20 + --bg-primary-color: rgb(7, 10, 13); 21 21 + --bg-secondary-color: rgb(13, 18, 23); 22 22 + --border-color: rgb(40, 45, 55); 23 23 + --table-stripe: rgba(255, 255, 255, 0.02); 24 24 + } 25 25 + } 26 26 + 27 27 + :root.dark-mode { 28 28 + --brand-color: rgb(16, 131, 254); 29 29 + --primary-color: rgb(255, 255, 255); 30 30 + --secondary-color: rgb(133, 152, 173); 31 31 + --bg-primary-color: rgb(7, 10, 13); 32 32 + --bg-secondary-color: rgb(13, 18, 23); 33 33 + --border-color: rgb(40, 45, 55); 34 34 + --table-stripe: rgba(255, 255, 255, 0.02); 35 35 + } 36 36 + 37 37 + /* --- Reset & Base ------------------------------------------- */ 38 38 + 39 39 + * { 40 40 + margin: 0; 41 41 + padding: 0; 42 42 + box-sizing: border-box; 43 43 + } 44 44 + 45 45 + body { 46 46 + font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif; 47 47 + background: var(--bg-secondary-color); 48 48 + color: var(--primary-color); 49 49 + text-rendering: optimizeLegibility; 50 50 + -webkit-font-smoothing: antialiased; 51 51 + } 52 52 + 53 53 + /* --- Layout: Sidebar + Main --------------------------------- */ 54 54 + 55 55 + .layout { 56 56 + display: flex; 57 57 + min-height: 100vh; 58 58 + } 59 59 + 60 60 + .sidebar { 61 61 + width: 220px; 62 62 + background: var(--bg-primary-color); 63 63 + border-right: 1px solid var(--border-color); 64 64 + padding: 20px 0; 65 65 + position: fixed; 66 66 + top: 0; 67 67 + left: 0; 68 68 + bottom: 0; 69 69 + overflow-y: auto; 70 70 + display: flex; 71 71 + flex-direction: column; 72 72 + } 73 73 + 74 74 + .sidebar-title { 75 75 + font-size: 0.8125rem; 76 76 + font-weight: 700; 77 77 + padding: 0 20px; 78 78 + margin-bottom: 4px; 79 79 + white-space: nowrap; 80 80 + overflow: hidden; 81 81 + text-overflow: ellipsis; 82 82 + } 83 83 + 84 84 + .sidebar-subtitle { 85 85 + font-size: 0.6875rem; 86 86 + color: var(--secondary-color); 87 87 + padding: 0 20px; 88 88 + margin-bottom: 20px; 89 89 + } 90 90 + 91 91 + .sidebar nav { 92 92 + flex: 1; 93 93 + } 94 94 + 95 95 + .sidebar nav a { 96 96 + display: block; 97 97 + padding: 8px 20px; 98 98 + font-size: 0.8125rem; 99 99 + color: var(--secondary-color); 100 100 + text-decoration: none; 101 101 + transition: background 0.1s, color 0.1s; 102 102 + } 103 103 + 104 104 + .sidebar nav a:hover { 105 105 + background: var(--bg-secondary-color); 106 106 + color: var(--primary-color); 107 107 + } 108 108 + 109 109 + .sidebar nav a.active { 110 110 + color: var(--brand-color); 111 111 + font-weight: 500; 112 112 + } 113 113 + 114 114 + .sidebar-footer { 115 115 + padding: 16px 20px 0; 116 116 + border-top: 1px solid var(--border-color); 117 117 + margin-top: 16px; 118 118 + } 119 119 + 120 120 + .sidebar-footer .session-info { 121 121 + font-size: 0.75rem; 122 122 + color: var(--secondary-color); 123 123 + margin-bottom: 8px; 124 124 + } 125 125 + 126 126 + .sidebar-footer form { 127 127 + display: inline; 128 128 + } 129 129 + 130 130 + .sidebar-footer button { 131 131 + background: none; 132 132 + border: none; 133 133 + font-size: 0.75rem; 134 134 + color: var(--secondary-color); 135 135 + cursor: pointer; 136 136 + padding: 0; 137 137 + text-decoration: underline; 138 138 + } 139 139 + 140 140 + .sidebar-footer button:hover { 141 141 + color: var(--primary-color); 142 142 + } 143 143 + 144 144 + .main { 145 145 + margin-left: 220px; 146 146 + flex: 1; 147 147 + padding: 32px; 148 148 + max-width: 960px; 149 149 + } 150 150 + 151 151 + /* --- Common Components -------------------------------------- */ 152 152 + 153 153 + .page-title { 154 154 + font-size: 1.5rem; 155 155 + font-weight: 700; 156 156 + margin-bottom: 24px; 157 157 + } 158 158 + 159 159 + .page-subtitle { 160 160 + font-size: 0.8125rem; 161 161 + color: var(--secondary-color); 162 162 + font-family: 'SF Mono', SFMono-Regular, Menlo, Consolas, monospace; 163 163 + margin-top: -20px; 164 164 + margin-bottom: 24px; 165 165 + word-break: break-all; 166 166 + } 167 167 + 168 168 + .page-description { 169 169 + font-size: 0.875rem; 170 170 + color: var(--secondary-color); 171 171 + margin-top: -16px; 172 172 + margin-bottom: 24px; 173 173 + } 174 174 + 175 175 + .flash-success { 176 176 + background: rgba(22, 163, 74, 0.1); 177 177 + color: var(--success-color); 178 178 + border: 1px solid rgba(22, 163, 74, 0.2); 179 179 + border-radius: 8px; 180 180 + padding: 10px 14px; 181 181 + font-size: 0.875rem; 182 182 + margin-bottom: 20px; 183 183 + } 184 184 + 185 185 + .flash-error { 186 186 + background: rgba(220, 38, 38, 0.1); 187 187 + color: var(--danger-color); 188 188 + border: 1px solid rgba(220, 38, 38, 0.2); 189 189 + border-radius: 8px; 190 190 + padding: 10px 14px; 191 191 + font-size: 0.875rem; 192 192 + margin-bottom: 20px; 193 193 + } 194 194 + 195 195 + /* --- Buttons ------------------------------------------------ */ 196 196 + 197 197 + .btn { 198 198 + display: inline-flex; 199 199 + align-items: center; 200 200 + justify-content: center; 201 201 + padding: 10px 20px; 202 202 + font-size: 0.875rem; 203 203 + font-weight: 500; 204 204 + border: none; 205 205 + border-radius: 8px; 206 206 + cursor: pointer; 207 207 + transition: opacity 0.15s; 208 208 + text-decoration: none; 209 209 + } 210 210 + 211 211 + .btn:hover { 212 212 + opacity: 0.85; 213 213 + } 214 214 + 215 215 + .btn-primary { 216 216 + background: var(--brand-color); 217 217 + color: #fff; 218 218 + } 219 219 + 220 220 + .btn-danger { 221 221 + background: var(--danger-color); 222 222 + color: #fff; 223 223 + border-color: var(--danger-color); 224 224 + } 225 225 + 226 226 + .btn-warning { 227 227 + background: var(--warning-color); 228 228 + color: #000; 229 229 + border-color: var(--warning-color); 230 230 + } 231 231 + 232 232 + .btn-small { 233 233 + padding: 6px 12px; 234 234 + font-size: 0.75rem; 235 235 + } 236 236 + 237 237 + .btn-outline-danger { 238 238 + background: transparent; 239 239 + color: var(--danger-color); 240 240 + border: 1px solid var(--danger-color); 241 241 + } 242 242 + 243 243 + /* --- Detail Sections ---------------------------------------- */ 244 244 + 245 245 + .detail-section { 246 246 + background: var(--bg-primary-color); 247 247 + border: 1px solid var(--border-color); 248 248 + border-radius: 10px; 249 249 + padding: 20px; 250 250 + margin-bottom: 16px; 251 251 + } 252 252 + 253 253 + .detail-section h3 { 254 254 + font-size: 0.875rem; 255 255 + font-weight: 600; 256 256 + margin-bottom: 12px; 257 257 + } 258 258 + 259 259 + .detail-row { 260 260 + display: flex; 261 261 + justify-content: space-between; 262 262 + align-items: center; 263 263 + padding: 8px 0; 264 264 + font-size: 0.8125rem; 265 265 + border-bottom: 1px solid var(--border-color); 266 266 + } 267 267 + 268 268 + .detail-row:last-child { 269 269 + border-bottom: none; 270 270 + } 271 271 + 272 272 + .detail-row .label { 273 273 + color: var(--secondary-color); 274 274 + flex-shrink: 0; 275 275 + } 276 276 + 277 277 + .detail-row .value { 278 278 + font-weight: 500; 279 279 + word-break: break-all; 280 280 + text-align: right; 281 281 + max-width: 65%; 282 282 + } 283 283 + 284 284 + .detail-row .value a { 285 285 + color: var(--brand-color); 286 286 + text-decoration: none; 287 287 + } 288 288 + 289 289 + .detail-row .value a:hover { 290 290 + text-decoration: underline; 291 291 + } 292 292 + 293 293 + /* --- Tables ------------------------------------------------- */ 294 294 + 295 295 + .table-container { 296 296 + background: var(--bg-primary-color); 297 297 + border: 1px solid var(--border-color); 298 298 + border-radius: 10px; 299 299 + overflow: hidden; 300 300 + } 301 301 + 302 302 + table { 303 303 + width: 100%; 304 304 + border-collapse: collapse; 305 305 + } 306 306 + 307 307 + thead th { 308 308 + text-align: left; 309 309 + padding: 12px 16px; 310 310 + font-size: 0.75rem; 311 311 + font-weight: 600; 312 312 + color: var(--secondary-color); 313 313 + text-transform: uppercase; 314 314 + letter-spacing: 0.5px; 315 315 + border-bottom: 1px solid var(--border-color); 316 316 + } 317 317 + 318 318 + tbody tr { 319 319 + border-bottom: 1px solid var(--border-color); 320 320 + } 321 321 + 322 322 + tbody tr:last-child { 323 323 + border-bottom: none; 324 324 + } 325 325 + 326 326 + tbody tr:nth-child(even) { 327 327 + background: var(--table-stripe); 328 328 + } 329 329 + 330 330 + tbody td { 331 331 + padding: 10px 16px; 332 332 + font-size: 0.8125rem; 333 333 + } 334 334 + 335 335 + tbody td a { 336 336 + color: var(--brand-color); 337 337 + text-decoration: none; 338 338 + } 339 339 + 340 340 + tbody td a:hover { 341 341 + text-decoration: underline; 342 342 + } 343 343 + 344 344 + /* --- Badges ------------------------------------------------- */ 345 345 + 346 346 + .badge { 347 347 + display: inline-block; 348 348 + padding: 2px 8px; 349 349 + border-radius: 4px; 350 350 + font-size: 0.75rem; 351 351 + font-weight: 500; 352 352 + } 353 353 + 354 354 + .badge-success { 355 355 + background: rgba(22, 163, 74, 0.1); 356 356 + color: var(--success-color); 357 357 + } 358 358 + 359 359 + .badge-danger { 360 360 + background: rgba(220, 38, 38, 0.1); 361 361 + color: var(--danger-color); 362 362 + } 363 363 + 364 364 + .badge-warning { 365 365 + background: rgba(234, 179, 8, 0.1); 366 366 + color: var(--warning-color); 367 367 + } 368 368 + 369 369 + /* --- Forms -------------------------------------------------- */ 370 370 + 371 371 + .form-card { 372 372 + background: var(--bg-primary-color); 373 373 + border: 1px solid var(--border-color); 374 374 + border-radius: 10px; 375 375 + padding: 24px; 376 376 + max-width: 480px; 377 377 + } 378 378 + 379 379 + .form-group { 380 380 + margin-bottom: 16px; 381 381 + } 382 382 + 383 383 + .form-group label { 384 384 + display: block; 385 385 + font-size: 0.8125rem; 386 386 + font-weight: 500; 387 387 + margin-bottom: 6px; 388 388 + color: var(--primary-color); 389 389 + } 390 390 + 391 391 + .form-group input { 392 392 + width: 100%; 393 393 + padding: 10px 12px; 394 394 + font-size: 0.875rem; 395 395 + border: 1px solid var(--border-color); 396 396 + border-radius: 8px; 397 397 + background: var(--bg-primary-color); 398 398 + color: var(--primary-color); 399 399 + outline: none; 400 400 + transition: border-color 0.15s; 401 401 + } 402 402 + 403 403 + .form-group input:focus { 404 404 + border-color: var(--brand-color); 405 405 + } 406 406 + 407 407 + .form-group .hint { 408 408 + font-size: 0.75rem; 409 409 + color: var(--secondary-color); 410 410 + margin-top: 4px; 411 411 + } 412 412 + 413 413 + .search-form { 414 414 + display: flex; 415 415 + gap: 8px; 416 416 + margin-bottom: 24px; 417 417 + } 418 418 + 419 419 + .search-form input { 420 420 + flex: 1; 421 421 + padding: 10px 12px; 422 422 + font-size: 0.875rem; 423 423 + border: 1px solid var(--border-color); 424 424 + border-radius: 8px; 425 425 + background: var(--bg-primary-color); 426 426 + color: var(--primary-color); 427 427 + outline: none; 428 428 + } 429 429 + 430 430 + .search-form input:focus { 431 431 + border-color: var(--brand-color); 432 432 + } 433 433 + 434 434 + .create-form { 435 435 + display: flex; 436 436 + gap: 8px; 437 437 + align-items: flex-end; 438 438 + margin-bottom: 24px; 439 439 + } 440 440 + 441 441 + .create-form .form-group { 442 442 + display: flex; 443 443 + flex-direction: column; 444 444 + gap: 4px; 445 445 + } 446 446 + 447 447 + .create-form label { 448 448 + font-size: 0.75rem; 449 449 + font-weight: 500; 450 450 + color: var(--secondary-color); 451 451 + } 452 452 + 453 453 + .create-form input[type="number"] { 454 454 + padding: 10px 12px; 455 455 + font-size: 0.875rem; 456 456 + border: 1px solid var(--border-color); 457 457 + border-radius: 8px; 458 458 + background: var(--bg-primary-color); 459 459 + color: var(--primary-color); 460 460 + outline: none; 461 461 + width: 120px; 462 462 + } 463 463 + 464 464 + .create-form input[type="number"]:focus { 465 465 + border-color: var(--brand-color); 466 466 + } 467 467 + 468 468 + /* --- Utility ------------------------------------------------ */ 469 469 + 470 470 + .mono-text { 471 471 + font-family: 'SF Mono', SFMono-Regular, Menlo, Consolas, monospace; 472 472 + font-size: 0.75rem; 473 473 + } 474 474 + 475 475 + .inline-form { 476 476 + display: inline; 477 477 + } 478 478 + 479 479 + .empty-state { 480 480 + text-align: center; 481 481 + padding: 40px 20px; 482 482 + color: var(--secondary-color); 483 483 + font-size: 0.875rem; 484 484 + } 485 485 + 486 486 + .load-more { 487 487 + text-align: center; 488 488 + padding: 16px; 489 489 + } 490 490 + 491 491 + .load-more a { 492 492 + color: var(--brand-color); 493 493 + text-decoration: none; 494 494 + font-size: 0.875rem; 495 495 + font-weight: 500; 496 496 + } 497 497 + 498 498 + .load-more a:hover { 499 499 + text-decoration: underline; 500 500 + } 501 501 + 502 502 + .pagination { 503 503 + display: flex; 504 504 + align-items: center; 505 505 + justify-content: center; 506 506 + gap: 16px; 507 507 + padding: 16px 0; 508 508 + } 509 509 + 510 510 + .pagination-info { 511 511 + font-size: 0.8125rem; 512 512 + color: var(--secondary-color); 513 513 + } 514 514 + 515 515 + /* --- Dashboard: Cards --------------------------------------- */ 516 516 + 517 517 + .cards { 518 518 + display: grid; 519 519 + grid-template-columns: repeat(auto-fill, minmax(260px, 1fr)); 520 520 + gap: 16px; 521 521 + margin-bottom: 32px; 522 522 + } 523 523 + 524 524 + .card { 525 525 + background: var(--bg-primary-color); 526 526 + border: 1px solid var(--border-color); 527 527 + border-radius: 10px; 528 528 + padding: 20px; 529 529 + } 530 530 + 531 531 + .card-label { 532 532 + font-size: 0.75rem; 533 533 + font-weight: 500; 534 534 + color: var(--secondary-color); 535 535 + text-transform: uppercase; 536 536 + letter-spacing: 0.5px; 537 537 + margin-bottom: 6px; 538 538 + } 539 539 + 540 540 + .card-value { 541 541 + font-size: 1.25rem; 542 542 + font-weight: 600; 543 543 + } 544 544 + 545 545 + .card-value.success { 546 546 + color: var(--success-color); 547 547 + } 548 548 + 549 549 + .card-value.danger { 550 550 + color: var(--danger-color); 551 551 + } 552 552 + 553 553 + /* --- Accounts: DID Cell ------------------------------------- */ 554 554 + 555 555 + .did-cell { 556 556 + font-family: 'SF Mono', SFMono-Regular, Menlo, Consolas, monospace; 557 557 + font-size: 0.75rem; 558 558 + color: var(--secondary-color); 559 559 + } 560 560 + 561 561 + /* --- Account Detail ----------------------------------------- */ 562 562 + 563 563 + .actions { 564 564 + display: flex; 565 565 + flex-wrap: wrap; 566 566 + gap: 8px; 567 567 + margin-top: 8px; 568 568 + } 569 569 + 570 570 + .actions form { 571 571 + display: inline; 572 572 + } 573 573 + 574 574 + .actions .btn { 575 575 + padding: 8px 16px; 576 576 + font-size: 0.8125rem; 577 577 + border: 1px solid var(--border-color); 578 578 + background: var(--bg-primary-color); 579 579 + color: var(--primary-color); 580 580 + } 581 581 + 582 582 + .actions .btn-primary { 583 583 + background: var(--brand-color); 584 584 + color: #fff; 585 585 + border-color: var(--brand-color); 586 586 + } 587 587 + 588 588 + .actions .btn-danger { 589 589 + background: var(--danger-color); 590 590 + color: #fff; 591 591 + border-color: var(--danger-color); 592 592 + } 593 593 + 594 594 + .actions .btn-warning { 595 595 + background: var(--warning-color); 596 596 + color: #000; 597 597 + border-color: var(--warning-color); 598 598 + } 599 599 + 600 600 + .password-box { 601 601 + background: rgba(22, 163, 74, 0.08); 602 602 + border: 1px solid rgba(22, 163, 74, 0.2); 603 603 + border-radius: 10px; 604 604 + padding: 16px 20px; 605 605 + margin-bottom: 16px; 606 606 + } 607 607 + 608 608 + .password-box .pw-label { 609 609 + font-size: 0.75rem; 610 610 + font-weight: 600; 611 611 + color: var(--success-color); 612 612 + margin-bottom: 6px; 613 613 + } 614 614 + 615 615 + .password-box .pw-value { 616 616 + font-family: 'SF Mono', SFMono-Regular, Menlo, Consolas, monospace; 617 617 + font-size: 1rem; 618 618 + font-weight: 600; 619 619 + user-select: all; 620 620 + } 621 621 + 622 622 + .back-link { 623 623 + display: inline-block; 624 624 + color: var(--brand-color); 625 625 + text-decoration: none; 626 626 + font-size: 0.8125rem; 627 627 + margin-bottom: 16px; 628 628 + } 629 629 + 630 630 + .back-link:hover { 631 631 + text-decoration: underline; 632 632 + } 633 633 + 634 634 + .collection-list { 635 635 + max-height: 200px; 636 636 + overflow-y: auto; 637 637 + padding: 8px 0; 638 638 + } 639 639 + 640 640 + .collection-item { 641 641 + font-family: 'SF Mono', SFMono-Regular, Menlo, Consolas, monospace; 642 642 + font-size: 0.75rem; 643 643 + padding: 4px 0; 644 644 + color: var(--secondary-color); 645 645 + border-bottom: 1px solid var(--border-color); 646 646 + } 647 647 + 648 648 + .collection-item:last-child { 649 649 + border-bottom: none; 650 650 + } 651 651 + 652 652 + .threat-sig { 653 653 + font-family: 'SF Mono', SFMono-Regular, Menlo, Consolas, monospace; 654 654 + font-size: 0.75rem; 655 655 + padding: 4px 0; 656 656 + color: var(--secondary-color); 657 657 + } 658 658 + 659 659 + /* --- Create Account ----------------------------------------- */ 660 660 + 661 661 + .success-card { 662 662 + background: var(--bg-primary-color); 663 663 + border: 1px solid var(--border-color); 664 664 + border-radius: 10px; 665 665 + padding: 24px; 666 666 + max-width: 480px; 667 667 + } 668 668 + 669 669 + .success-card h3 { 670 670 + font-size: 1rem; 671 671 + font-weight: 600; 672 672 + color: var(--success-color); 673 673 + margin-bottom: 16px; 674 674 + } 675 675 + 676 676 + .success-card .detail-row .value { 677 677 + display: flex; 678 678 + align-items: center; 679 679 + gap: 6px; 680 680 + } 681 681 + 682 682 + .password-highlight { 683 683 + font-family: 'SF Mono', SFMono-Regular, Menlo, Consolas, monospace; 684 684 + background: rgba(22, 163, 74, 0.08); 685 685 + padding: 2px 6px; 686 686 + border-radius: 4px; 687 687 + user-select: all; 688 688 + } 689 689 + 690 690 + .copy-btn { 691 691 + background: none; 692 692 + border: 1px solid var(--border-color); 693 693 + border-radius: 4px; 694 694 + padding: 2px 6px; 695 695 + font-size: 0.6875rem; 696 696 + cursor: pointer; 697 697 + color: var(--secondary-color); 698 698 + transition: color 0.15s, border-color 0.15s; 699 699 + white-space: nowrap; 700 700 + } 701 701 + 702 702 + .copy-btn:hover { 703 703 + color: var(--primary-color); 704 704 + border-color: var(--primary-color); 705 705 + } 706 706 + 707 707 + /* --- Invite Codes ------------------------------------------- */ 708 708 + 709 709 + .code-box { 710 710 + background: rgba(22, 163, 74, 0.08); 711 711 + border: 1px solid rgba(22, 163, 74, 0.2); 712 712 + border-radius: 10px; 713 713 + padding: 16px 20px; 714 714 + margin-bottom: 24px; 715 715 + } 716 716 + 717 717 + .code-box .code-label { 718 718 + font-size: 0.75rem; 719 719 + font-weight: 600; 720 720 + color: var(--success-color); 721 721 + margin-bottom: 6px; 722 722 + } 723 723 + 724 724 + .code-box .code-value { 725 725 + font-family: 'SF Mono', SFMono-Regular, Menlo, Consolas, monospace; 726 726 + font-size: 1rem; 727 727 + font-weight: 600; 728 728 + user-select: all; 729 729 + } 730 730 + 731 731 + .code-cell { 732 732 + font-family: 'SF Mono', SFMono-Regular, Menlo, Consolas, monospace; 733 733 + font-size: 0.75rem; 734 734 + } 735 735 + 736 736 + /* --- Login Page --------------------------------------------- */ 737 737 + 738 738 + .login-card { 739 739 + background: var(--bg-primary-color); 740 740 + border: 1px solid var(--border-color); 741 741 + border-radius: 12px; 742 742 + padding: 40px; 743 743 + width: 100%; 744 744 + max-width: 400px; 745 745 + margin: 20px; 746 746 + } 747 747 + 748 748 + .login-title { 749 749 + font-size: 1.5rem; 750 750 + font-weight: 700; 751 751 + text-align: center; 752 752 + margin-bottom: 4px; 753 753 + } 754 754 + 755 755 + .login-subtitle { 756 756 + font-size: 0.875rem; 757 757 + color: var(--secondary-color); 758 758 + text-align: center; 759 759 + margin-bottom: 32px; 760 760 + } 761 761 + 762 762 + .login-card .form-group { 763 763 + margin-bottom: 20px; 764 764 + } 765 765 + 766 766 + .login-card .form-group label { 767 767 + font-size: 0.875rem; 768 768 + } 769 769 + 770 770 + .login-card .btn-primary { 771 771 + width: 100%; 772 772 + } 773 773 + 774 774 + .error-msg { 775 775 + background: rgba(220, 38, 38, 0.1); 776 776 + color: var(--danger-color); 777 777 + border: 1px solid rgba(220, 38, 38, 0.2); 778 778 + border-radius: 8px; 779 779 + padding: 10px 14px; 780 780 + font-size: 0.875rem; 781 781 + margin-bottom: 20px; 782 782 + } 783 783 + 784 784 + /* --- Error Page ---------------------------------------------- */ 785 785 + 786 786 + .centered { 787 787 + display: flex; 788 788 + align-items: center; 789 789 + justify-content: center; 790 790 + min-height: 100vh; 791 791 + } 792 792 + 793 793 + .error-card { 794 794 + background: var(--bg-primary-color); 795 795 + border: 1px solid var(--border-color); 796 796 + border-radius: 12px; 797 797 + padding: 40px; 798 798 + text-align: center; 799 799 + max-width: 480px; 800 800 + width: 100%; 801 801 + margin: 20px; 802 802 + } 803 803 + 804 804 + .error-card--inset { 805 805 + margin: 60px auto; 806 806 + } 807 807 + 808 808 + .error-icon { 809 809 + font-size: 2.5rem; 810 810 + margin-bottom: 16px; 811 811 + color: var(--danger-color); 812 812 + } 813 813 + 814 814 + .error-title { 815 815 + font-size: 1.25rem; 816 816 + font-weight: 700; 817 817 + margin-bottom: 8px; 818 818 + } 819 819 + 820 820 + .error-message { 821 821 + font-size: 0.875rem; 822 822 + color: var(--secondary-color); 823 823 + margin-bottom: 24px; 824 824 + line-height: 1.5; 825 825 + } 826 826 + 827 827 + .error-link { 828 828 + display: inline-flex; 829 829 + align-items: center; 830 830 + justify-content: center; 831 831 + padding: 10px 20px; 832 832 + font-size: 0.875rem; 833 833 + font-weight: 500; 834 834 + border: none; 835 835 + border-radius: 8px; 836 836 + cursor: pointer; 837 837 + text-decoration: none; 838 838 + background: var(--brand-color); 839 839 + color: #fff; 840 840 + transition: opacity 0.15s; 841 841 + } 842 842 + 843 843 + .error-link:hover { 844 844 + opacity: 0.85; 845 845 + } 846 846 + 847 847 + /* --- Mobile: Topbar + Hamburger ----------------------------- */ 848 848 + 849 849 + .topbar { 850 850 + display: none; 851 851 + position: fixed; 852 852 + top: 0; 853 853 + left: 0; 854 854 + right: 0; 855 855 + height: 52px; 856 856 + background: var(--bg-primary-color); 857 857 + border-bottom: 1px solid var(--border-color); 858 858 + align-items: center; 859 859 + padding: 0 16px; 860 860 + gap: 12px; 861 861 + z-index: 100; 862 862 + } 863 863 + 864 864 + .topbar-title { 865 865 + font-size: 0.875rem; 866 866 + font-weight: 600; 867 867 + overflow: hidden; 868 868 + text-overflow: ellipsis; 869 869 + white-space: nowrap; 870 870 + flex: 1; 871 871 + } 872 872 + 873 873 + .hamburger { 874 874 + background: none; 875 875 + border: none; 876 876 + cursor: pointer; 877 877 + padding: 4px; 878 878 + display: flex; 879 879 + flex-direction: column; 880 880 + gap: 5px; 881 881 + flex-shrink: 0; 882 882 + } 883 883 + 884 884 + .hamburger span { 885 885 + display: block; 886 886 + width: 22px; 887 887 + height: 2px; 888 888 + background: var(--primary-color); 889 889 + border-radius: 2px; 890 890 + transition: transform 0.25s ease, opacity 0.25s ease; 891 891 + } 892 892 + 893 893 + body.sidebar-open .hamburger span:nth-child(1) { 894 894 + transform: translateY(7px) rotate(45deg); 895 895 + } 896 896 + 897 897 + body.sidebar-open .hamburger span:nth-child(2) { 898 898 + opacity: 0; 899 899 + } 900 900 + 901 901 + body.sidebar-open .hamburger span:nth-child(3) { 902 902 + transform: translateY(-7px) rotate(-45deg); 903 903 + } 904 904 + 905 905 + .sidebar-overlay { 906 906 + display: none; 907 907 + position: fixed; 908 908 + inset: 0; 909 909 + background: rgba(0, 0, 0, 0.4); 910 910 + z-index: 149; 911 911 + } 912 912 + 913 913 + /* --- Responsive --------------------------------------------- */ 914 914 + 915 915 + @media (max-width: 768px) { 916 916 + .topbar { 917 917 + display: flex; 918 918 + } 919 919 + 920 920 + .sidebar { 921 921 + transform: translateX(-220px); 922 922 + transition: transform 0.25s ease; 923 923 + z-index: 150; 924 924 + } 925 925 + 926 926 + body.sidebar-open .sidebar { 927 927 + transform: translateX(0); 928 928 + } 929 929 + 930 930 + body.sidebar-open .sidebar-overlay { 931 931 + display: block; 932 932 + } 933 933 + 934 934 + .main { 935 935 + margin-left: 0; 936 936 + padding: 24px 16px; 937 937 + padding-top: 76px; /* 52px topbar + 24px breathing room */ 938 938 + } 939 939 + 940 940 + /* Tables scroll horizontally */ 941 941 + .table-container { 942 942 + overflow-x: auto; 943 943 + -webkit-overflow-scrolling: touch; 944 944 + } 945 945 + 946 946 + /* Cards: single column */ 947 947 + .cards { 948 948 + grid-template-columns: 1fr; 949 949 + } 950 950 + 951 951 + /* Form cards: full width */ 952 952 + .form-card, 953 953 + .success-card { 954 954 + max-width: 100%; 955 955 + } 956 956 + 957 957 + /* Search / create forms: stack vertically */ 958 958 + .search-form, 959 959 + .create-form { 960 960 + flex-direction: column; 961 961 + align-items: stretch; 962 962 + } 963 963 + 964 964 + .create-form input[type="number"] { 965 965 + width: 100%; 966 966 + } 967 967 + 968 968 + /* Detail rows wrap on narrow screens */ 969 969 + .detail-row { 970 970 + flex-wrap: wrap; 971 971 + gap: 4px; 972 972 + } 973 973 + 974 974 + .detail-row .value { 975 975 + max-width: 100%; 976 976 + text-align: left; 977 977 + } 978 978 + 979 979 + /* Actions wrap tightly */ 980 980 + .actions { 981 981 + flex-direction: column; 982 982 + align-items: flex-start; 983 983 + } 984 984 + 985 985 + .actions form, 986 986 + .actions .btn { 987 987 + width: 100%; 988 988 + display: block; 989 989 + text-align: center; 990 990 + } 991 991 + }

+27

static/js/admin.js

··· 1 1 + document.addEventListener('DOMContentLoaded', function () { 2 2 + var hamburger = document.getElementById('hamburger'); 3 3 + var overlay = document.getElementById('sidebar-overlay'); 4 4 + 5 5 + function openSidebar() { 6 6 + document.body.classList.add('sidebar-open'); 7 7 + } 8 8 + 9 9 + function closeSidebar() { 10 10 + document.body.classList.remove('sidebar-open'); 11 11 + } 12 12 + 13 13 + if (hamburger) { 14 14 + hamburger.addEventListener('click', function () { 15 15 + document.body.classList.toggle('sidebar-open'); 16 16 + }); 17 17 + } 18 18 + 19 19 + if (overlay) { 20 20 + overlay.addEventListener('click', closeSidebar); 21 21 + } 22 22 + 23 23 + // Close sidebar when a nav link is tapped on mobile 24 24 + document.querySelectorAll('.sidebar nav a').forEach(function (link) { 25 25 + link.addEventListener('click', closeSidebar); 26 26 + }); 27 27 + });