Skip to content

Add UI route authorization and decouple admin routes #918

@jescalada

Description

@jescalada

Is your feature request related to a problem? Please describe.
To improve security and make access more granular, we'd like to add authorization to UI routes. In other words, we want users to log in if they wish to access any route. Furthermore, only admins should be able to see certain resources (such as the list of users and their details, changing a user's admin status, and so on).

Currently, even unlogged users can see the list of users, access admin routes, etc. We're not sure if this is by design, but we feel it would help to make access more strict.

Describe the solution you'd like
A basic frontend route guard could check a user's auth and admin status and redirect them accordingly (to the login page, "unauthorized" page, or actual page).

Describe alternatives you've considered
None

Additional context
Our biggest concern is how our route changes will affect current users. Are users currently using git-proxy without logging in or distinguishing between admins and non-admins?

Our changes may affect their current workflow, so ideally we want to make things as intuitive as possible and back them up with documentation so they can keep using the library as usual.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions