infosave2007
3d9cc02963
- Add PHP LDAP extension to Docker container - Implement LdapSync class for authentication and user synchronization - Add automatic user sync via cron (every 30 minutes) - Create role-based access control system (admin, manager, viewer) - Add LDAP configuration UI in settings - Support for both Active Directory and OpenLDAP - Group-to-role mapping with flexible configuration - Add 50+ translations (EN + RU) for LDAP features - Include comprehensive setup documentation - Enhance Auth::login() with LDAP fallback - Add LDAP settings page with connection testing
33 lines
1.5 KiB
SQL
33 lines
1.5 KiB
SQL
-- Migration: Add user roles and permissions
|
|
-- Date: 2025-11-10
|
|
|
|
-- User roles table
|
|
CREATE TABLE IF NOT EXISTS user_roles (
|
|
id INT PRIMARY KEY AUTO_INCREMENT,
|
|
name VARCHAR(50) NOT NULL UNIQUE,
|
|
display_name VARCHAR(100) NOT NULL,
|
|
description TEXT,
|
|
permissions JSON NOT NULL,
|
|
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
|
|
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
|
|
|
|
-- Add role to users table
|
|
ALTER TABLE users
|
|
ADD COLUMN role VARCHAR(50) DEFAULT 'viewer' AFTER ldap_dn,
|
|
ADD INDEX idx_role (role);
|
|
|
|
-- Insert default roles
|
|
INSERT IGNORE INTO user_roles (name, display_name, description, permissions) VALUES
|
|
('admin', 'Administrator', 'Full access to all features', JSON_ARRAY('*')),
|
|
('manager', 'Manager', 'Can manage servers and clients', JSON_ARRAY('servers.view', 'servers.create', 'servers.edit', 'clients.view', 'clients.create', 'clients.edit', 'clients.delete')),
|
|
('viewer', 'Viewer', 'Can only view own clients', JSON_ARRAY('clients.view_own', 'clients.download_own'));
|
|
|
|
-- Insert default LDAP group mappings (examples)
|
|
INSERT IGNORE INTO ldap_group_mappings (ldap_group, role_name, description) VALUES
|
|
('vpn-admins', 'admin', 'VPN administrators with full access'),
|
|
('vpn-managers', 'manager', 'VPN managers who can create and manage clients'),
|
|
('vpn-users', 'viewer', 'Regular VPN users with view-only access');
|
|
|
|
-- Update existing users to admin role (backward compatibility)
|
|
UPDATE users SET role = 'admin' WHERE role IS NULL OR role = '';
|