src-advisory/SRCmail
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: show admin panel in sidebar for Stalwart admin users

Browse Source
This commit is contained in:
Linus Rath
2026-03-27 01:53:16 +01:00
parent b75d064f20
commit a9002763e2
5 changed files with 135 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/admin/layout.tsx
+55 -1
View File
@@ -14,6 +14,11 @@ import {
KeyRound,
Puzzle,
SwatchBook,
Mail,
Calendar,
BookUser,
HardDrive,
ArrowLeft,
} from 'lucide-react';
import { cn } from '@/lib/utils';
import { useConfig } from '@/hooks/use-config';
@@ -139,7 +144,56 @@ export default function AdminLayout({ children }: { children: React.ReactNode })
return (
<div className="min-h-screen flex bg-background">
{/* Sidebar */}
{/* Slim webmail nav rail */}
<nav className="w-14 bg-secondary flex flex-col items-center py-3 gap-2 border-r border-border sticky top-0 h-screen shrink-0">
{logoUrl ? (
<img src={logoUrl} alt="" className="w-7 h-7 object-contain mb-2" />
) : (
<div className="w-7 h-7 mb-2" />
)}
<a
href="/"
className="flex items-center justify-center w-10 h-10 rounded-md transition-colors text-muted-foreground hover:text-foreground hover:bg-muted"
title="Mail"
>
<Mail className="w-[18px] h-[18px]" />
</a>
<a
href="/calendar"
className="flex items-center justify-center w-10 h-10 rounded-md transition-colors text-muted-foreground hover:text-foreground hover:bg-muted"
title="Calendar"
>
<Calendar className="w-[18px] h-[18px]" />
</a>
<a
href="/contacts"
className="flex items-center justify-center w-10 h-10 rounded-md transition-colors text-muted-foreground hover:text-foreground hover:bg-muted"
title="Contacts"
>
<BookUser className="w-[18px] h-[18px]" />
</a>
<a
href="/files"
className="flex items-center justify-center w-10 h-10 rounded-md transition-colors text-muted-foreground hover:text-foreground hover:bg-muted"
title="Files"
>
<HardDrive className="w-[18px] h-[18px]" />
</a>
<div className="mt-auto flex flex-col items-center gap-2">
<div className="flex items-center justify-center w-10 h-10 rounded-md bg-primary/10 text-primary" title="Admin">
<Shield className="w-[18px] h-[18px]" />
</div>
<a
href="/settings"
className="flex items-center justify-center w-10 h-10 rounded-md transition-colors text-muted-foreground hover:text-foreground hover:bg-muted"
title="Settings"
>
<Settings className="w-[18px] h-[18px]" />
</a>
</div>
</nav>
{/* Admin Sidebar */}
<aside className="w-60 border-r border-border bg-secondary flex flex-col sticky top-0 h-screen">
<div className="h-14 flex items-center px-4 border-b border-border shrink-0">
{logoUrl ? (
app/api/admin/auth/route.ts
+11 -11
View File
@@ -7,24 +7,24 @@ import { logger } from '@/lib/logger';
import { getStalwartCredentials } from '@/lib/stalwart/credentials';
/**
* Check if the current user is a Stalwart admin via principal roles.
* Check if the current user is a Stalwart admin by probing an admin-only endpoint.
*/
async function checkStalwartAdmin(request: NextRequest): Promise<boolean> {
try {
const creds = await getStalwartCredentials(request);
if (!creds) return false;
const response = await fetch(
`${creds.apiUrl}/api/principal/${encodeURIComponent(creds.username)}`,
{ method: 'GET', headers: { 'Authorization': creds.authHeader } }
);
if (!response.ok) return false;
// Probe admin-only endpoint: listing principals requires admin privileges
const response = await fetch(`${creds.apiUrl}/api/principal?limit=1`, {
method: 'GET',
headers: { 'Authorization': creds.authHeader },
});
const data = await response.json();
const principal = data.data ?? data;
const roles: string[] = Array.isArray(principal?.roles) ? principal.roles : [];
return roles.includes('admin');
} catch {
const isAdmin = response.ok;
logger.info('Stalwart admin check (auth)', { username: creds.username, status: response.status, isAdmin });
return isAdmin;
} catch (error) {
logger.debug('Stalwart admin check error', { error: error instanceof Error ? error.message : 'Unknown' });
return false;
}
}
app/api/admin/stalwart-check/route.ts
+11 -19
View File
@@ -4,8 +4,8 @@ import { getStalwartCredentials } from '@/lib/stalwart/credentials';
/**
* GET /api/admin/stalwart-check
* Check if the currently logged-in user has the 'admin' role in Stalwart.
* Uses the user's JMAP session credentials.
* Check if the currently logged-in user is a Stalwart admin.
* Probes the admin-only principal-list endpoint — if the user can access it, they're an admin.
*/
export async function GET(request: NextRequest) {
try {
@@ -16,24 +16,16 @@ export async function GET(request: NextRequest) {
});
}
const response = await fetch(
`${creds.apiUrl}/api/principal/${encodeURIComponent(creds.username)}`,
{
method: 'GET',
headers: { 'Authorization': creds.authHeader },
}
);
// Probe an admin-only endpoint: listing principals requires admin privileges.
// Use limit=1 to minimize payload.
const url = `${creds.apiUrl}/api/principal?limit=1`;
const response = await fetch(url, {
method: 'GET',
headers: { 'Authorization': creds.authHeader },
});
if (!response.ok) {
return NextResponse.json({ isStalwartAdmin: false }, {
headers: { 'Cache-Control': 'no-store' },
});
}
const data = await response.json();
const principal = data.data ?? data;
const roles: string[] = Array.isArray(principal?.roles) ? principal.roles : [];
const isStalwartAdmin = roles.includes('admin');
const isStalwartAdmin = response.ok;
logger.info('Stalwart admin check', { username: creds.username, status: response.status, isStalwartAdmin });
return NextResponse.json({ isStalwartAdmin }, {
headers: { 'Cache-Control': 'no-store' },