spencermandClaude Opus 5.5
a82e056b6a
Admin: Departments (name and stations; add shows the three groups IT must create), Profiles (welder stamp, station limits, active) with a CSV import that previews and applies only when clean, Checklists (weld and plain), Security (session, lockout and rate-limit settings with bounds, alerts for the last 24 hours, the integrity result), Access log with filters and a guarded CSV, Who is in, Stamp check, Notifications, and the employeeID flags. Every Admin change is audited. Worker: ad-reconcile (nightly and on "refresh from AD now"), session-refresh (15 minutes), integrity (seals, asset hashes, missing and orphan files, the audit chain), backup-check, notify-send and notify-digest. Notifications route per event type to AD groups, users, mailboxes or the department Supervisor group, immediately or in a daily digest, over STARTTLS verified against the PESCO CA, with dry run on the test stack. Backups: scripts/backup/ps-backup.sh and ps-restore.sh with a systemd timer at 02:00 America/Denver. Restore rehearsed on the test stack 2026-10-21. CI: pip-audit and npm audit. pypdf 6.21.1 and certifi 2026.10.19. Migration 0010. Closes the app part of I6, M3, O1, O2 and S3. Co-Authored-By: Claude Opus 5.5 <[email protected]>
64 lines
2.7 KiB
TypeScript
64 lines
2.7 KiB
TypeScript
// Typed calls for the phase 1 endpoints. Paths and shapes follow the design contract.
|
|
import { api } from "../api/client";
|
|
import type {
|
|
AccessLogRow,
|
|
AccountInfo,
|
|
AdLookup,
|
|
AdminDevice,
|
|
AdminUser,
|
|
AdminUserDetail,
|
|
AuthContextInfo,
|
|
Department,
|
|
DeviceRef,
|
|
Factor,
|
|
GroupMap,
|
|
Me,
|
|
PinState,
|
|
SessionRow,
|
|
SigninAttempt,
|
|
} from "./types";
|
|
|
|
const enc = encodeURIComponent;
|
|
|
|
export const authApi = {
|
|
context: (signal?: AbortSignal) => api.get<AuthContextInfo>("/api/auth/context", signal),
|
|
me: (signal?: AbortSignal) => api.get<Me>("/api/auth/me", signal),
|
|
signInPassword: (login: string, password: string) =>
|
|
api.post<Me>("/api/auth/signin/password", { login, password }),
|
|
signInPin: (emp_no: string, pin: string) => api.post<Me>("/api/auth/signin/pin", { emp_no, pin }),
|
|
signOut: () => api.post<null>("/api/auth/signout"),
|
|
lock: () => api.post<null>("/api/auth/lock"),
|
|
visibility: (hidden: boolean) => api.post<null>("/api/auth/visibility", { hidden }),
|
|
unlock: (factor: Factor, secret: string) => api.post<Me>("/api/auth/unlock", { factor, secret }),
|
|
};
|
|
|
|
export const accountApi = {
|
|
get: (signal?: AbortSignal) => api.get<AccountInfo>("/api/account", signal),
|
|
setPin: (password: string, pin: string) =>
|
|
api.post<{ pin: PinState }>("/api/account/pin", { password, pin }),
|
|
sessions: (signal?: AbortSignal) => api.get<SessionRow[]>("/api/account/sessions", signal),
|
|
signOutOthers: () => api.post<{ revoked: number }>("/api/account/sessions/signout-others"),
|
|
accessLog: (limit = 50, signal?: AbortSignal) =>
|
|
api.get<AccessLogRow[]>(`/api/account/access-log?limit=${limit}`, signal),
|
|
registerDevice: (name: string) => api.post<{ device: DeviceRef }>("/api/account/device", { name }),
|
|
};
|
|
|
|
export const adminApi = {
|
|
users: (q: string, signal?: AbortSignal) =>
|
|
api.get<AdminUser[]>(q ? `/api/admin/users?q=${enc(q)}` : "/api/admin/users", signal),
|
|
user: (id: string, signal?: AbortSignal) => api.get<AdminUserDetail>(`/api/admin/users/${enc(id)}`, signal),
|
|
lookup: (login: string, signal?: AbortSignal) =>
|
|
api.get<AdLookup>(`/api/admin/ad/lookup?login=${enc(login)}`, signal),
|
|
clearPin: (id: string, reason: string) =>
|
|
api.delWithBody<null>(`/api/admin/users/${enc(id)}/pin`, { reason }),
|
|
devices: (signal?: AbortSignal) => api.get<AdminDevice[]>("/api/admin/devices", signal),
|
|
revokeDevice: (id: string) => api.del<null>(`/api/admin/devices/${enc(id)}`),
|
|
groups: (signal?: AbortSignal) => api.get<GroupMap>("/api/admin/groups", signal),
|
|
signinAttempts: (limit = 100, signal?: AbortSignal) =>
|
|
api.get<SigninAttempt[]>(`/api/admin/signin-attempts?limit=${limit}`, signal),
|
|
};
|
|
|
|
export const departmentsApi = {
|
|
list: (signal?: AbortSignal) => api.get<Department[]>("/api/departments", signal),
|
|
};
|