root
10c72de859
Nieuwe features: - Admin gebruikerslijst met zoeken/filter op gebruikersnaam en rol - Profiel bewerken pagina met wachtwoord wijzigen en rol wijzigen - Nieuwe gebruiker aanmaken via aparte pagina - CLI commando cli/reset-admin-password.php voor admin wachtword reset + lockout reset Architectuur: - /admin/users: lijst met zoekveld, rol filter, bewerk/verwijder acties - /admin/users-edit?user=<naam>: profiel, wachtwoord, rol, verwijderen - /admin/users-new: nieuwe gebruiker aanmaken - AdminAuth::clearLockout() public methode voor CLI gebruik Documentatie: - guide/nl/en/admin-beheerder/gebruikers.md herschreven - 15 nieuwe admin vertaalkeys in NL/EN/DE - Release notes: docs/release-notes/v2.6.1c.md Tests: - Pentest: 30/30 geslaagd, 0 vulnerabilities - WCAG 2.1 AA: 25/25 geslaagd, 100% compliance
80 lines
2.6 KiB
Markdown
80 lines
2.6 KiB
Markdown
# Users
|
|
|
|
Users are stored in `admin/config/admin.json` (file-based, no database). Each user has a **role** that determines which admin routes and sidebar items are visible.
|
|
|
|
## Roles
|
|
|
|
CodePress has four roles, defined in `AdminAuth::ROLE_PERMISSIONS`:
|
|
|
|
| Role | Label | Permissions |
|
|
|------|-------|-------------|
|
|
| `admin` | Admin | Everything (`*`) |
|
|
| `content-manager` | Content Manager | Content management, guide |
|
|
| `bi-manager` | BI Manager | Statistics, logs, guide |
|
|
| `site-admin` | Site Admin | Theme, plugins, statistics, logs, update, guide |
|
|
|
|
Roles are displayed with their label via `AdminAuth::ROLE_LABELS`.
|
|
|
|
## Users list (`/admin/users`)
|
|
|
|
The users list shows all users with their username, role, login email and creation date.
|
|
|
|
### Search and filter
|
|
|
|
- **Search field**: search by username, email or author name
|
|
- **Role filter**: filter by a specific role via the dropdown
|
|
- Click **Filter** to apply the results
|
|
|
|
### Adding a new user
|
|
|
|
1. Click **New user** (top right of the list)
|
|
2. Enter username, password (minimum 8 characters), email, author name and author email
|
|
3. Select a role
|
|
4. Click **Add user**
|
|
5. You will be automatically redirected to the profile page of the new user
|
|
|
|
## Editing a profile (`/admin/users-edit?user=<name>`)
|
|
|
|
Click on a user in the list to edit their profile. The profile page contains three sections:
|
|
|
|
### Profile information
|
|
- Login email, author name and author email can be changed
|
|
- The username cannot be changed
|
|
|
|
### Change password
|
|
- Enter a new password (minimum 8 characters)
|
|
- Confirm the password
|
|
- The password is stored as a bcrypt hash
|
|
|
|
### Change role
|
|
- Shows the current role with a colored badge
|
|
- Select a new role from the dropdown
|
|
- The change immediately affects the visible admin routes and sidebar items
|
|
|
|
### Delete user (Danger zone)
|
|
- Only visible for other users (not for your own account)
|
|
- Confirmation via JavaScript dialog
|
|
- After deletion you return to the users list
|
|
|
|
## Admin password reset via CLI
|
|
|
|
If the admin is locked out (e.g. due to brute-force lockout or forgotten password), the password can be reset via the CLI:
|
|
|
|
```bash
|
|
# Reset with a specific password
|
|
php cli/reset-admin-password.php admin NewPassword123
|
|
|
|
# Reset with an automatically generated password
|
|
php cli/reset-admin-password.php admin
|
|
```
|
|
|
|
The command:
|
|
- Changes the password (as a bcrypt hash)
|
|
- Clears the brute-force lockout for the user
|
|
- Displays the new password in the terminal
|
|
|
|
## Access control
|
|
|
|
- Route access is checked in `public/admin.php` via `AdminAuth::hasPermission()`
|
|
- Unauthorized routes return a **403 error**
|
|
- Sidebar items are conditionally shown via the `has_permission()` Twig function in `admin.twig` |