diff --git a/templates/view.html b/templates/view.html
new file mode 100644
index 0000000..22ed400
--- /dev/null
+++ b/templates/view.html
@@ -0,0 +1,127 @@
+{% extends "_primary.html" %}
+
+{% block content %}
+
+ View {{ client.get("name") }} configuration
+
+ {%- if manager_type and manager_type in ["owner", "manager", "viewer"] %}
+
+
Client ID
+
{{ client_id }}
+
+ {%- if client.get("description", None) %}
+
Client Description
+
{{ client.get("description") }}
+ {%- endif %}
+
+ {%- if client.get("owners", []) %}
+
Client Owners
+
+ Owners can manage all aspects of this application, including resetting the client secret
+
+
+ {%- for em in client.get("owners", []) | sort %}
+ - {{ em }}
+ {%- endfor %}
+
+ {%- endif %}
+
+ {%- if client.get("managers", []) %}
+
Client Managers
+
+ Managers can manage this application's allowed/blocked list and some other settings
+
+
+ {%- for em in client.get("managers", []) | sort %}
+ - {{ em }}
+ {%- endfor %}
+
+ {%- endif %}
+
+ {%- if client.get("viewers", []) %}
+
Client Viewers
+
+ Viewers can view some settings via this current page
+
+
+ {%- for em in client.get("viewers", []) | sort %}
+ - {{ em }}
+ {%- endfor %}
+
+ {%- endif %}
+
+ {%- if client.get("blocked_domains", []) %}
+
Blocked domains
+
+ Blocked domains take precedence over any allowed domains or emails
+
+
+ {%- for d in client.get("blocked_domains", []) | sort %}
+ - {{ d }}
+ - *.{{ d }}
+ {%- endfor %}
+
+ {%- endif %}
+
+ {%- if client.get("blocked_emails", []) %}
+
Blocked emails
+
+ Blocked emails take precedence over any allowed domains or emails
+
+
+ {%- for em in client.get("blocked_emails", []) | sort %}
+ - {{ em }}
+ {%- endfor %}
+
+ {%- endif %}
+
+ {%- if client.get("allowed_emails", []) %}
+
Allowed emails
+
+ The below emails can authenticate using this client. Note that the client may include additional authorisation steps that prevents user access.
+
+
+ {%- for em in client.get("allowed_emails", []) | sort %}
+ - {{ em }}
+ {%- endfor %}
+
+ {%- endif %}
+
+ {%- if client.get("allowed_domains", []) %}
+
Allowed domains
+
+ Users with email addresses ending in the below domains can authenticate using this client. Note that the client may include additional authorisation steps that prevents user access.
+
+
+ {%- for d in client.get("allowed_domains", []) | sort %}
+ - {{ d }}
+ - *.{{ d }}
+ {%- endfor %}
+
+ {%- endif %}
+
+
+
+{% endblock %}
diff --git a/wsgi.py b/wsgi.py
index f3c992b..783ef17 100644
--- a/wsgi.py
+++ b/wsgi.py
@@ -1246,6 +1246,7 @@ def signout(country_missmatch: bool = False):
return redirect(redirect_url)
+@app.route("/view", methods=["GET"])
@app.route("/manage", methods=["GET", "POST"])
@UserShouldBeSignedIn
@SetBrowserCookie
@@ -1294,6 +1295,7 @@ def route_manage():
owners = client.get("owners", [])
managers = client.get("managers", [])
+ viewers = client.get("viewers", [])
manager_type = None
@@ -1305,6 +1307,8 @@ def route_manage():
manager_type = "owner"
elif users_email and users_email in managers:
manager_type = "manager"
+ elif users_email and users_email in viewers:
+ manager_type = "viewer"
if not manager_type:
jprint(
@@ -1317,6 +1321,19 @@ def route_manage():
)
return redirect("/dashboard?error=management-no-access")
+ if "view" in request.path or manager_type == "viewer":
+ return renderTemplate(
+ "view.html",
+ {
+ "session": session,
+ "client_id": client_id,
+ "manager_type": manager_type,
+ "client": client,
+ "title": "View",
+ "nav_item": "view",
+ },
+ )
+
client_json = None
client_json_lines = 0
@@ -1347,9 +1364,10 @@ def route_manage():
else:
new_config["secret"] = client["secret"]
- if manager_type == "manager":
+ if manager_type != "owner":
new_config["owners"] = client.get("owners", [])
new_config["managers"] = client.get("managers", [])
+ new_config["viewers"] = client.get("viewers", [])
save_success = sso_oidc.save_client(
filename=client.get("_filename", None),
@@ -1409,6 +1427,20 @@ def dashboard():
else f"Open {name}"
)
+ can_view = (
+ True
+ if (
+ users_email
+ in (
+ client.get("owners", [])
+ + client.get("managers", [])
+ + client.get("viewers", [])
+ )
+ or users_email in SUPERUSERS
+ )
+ else False
+ )
+
can_manage = (
True
if (
@@ -1435,6 +1467,7 @@ def dashboard():
"sign_in_url": sign_in_url,
"button_text": button_text,
"dashboard_display": dashboard_display,
+ "can_view": can_view,
"can_manage": can_manage,
}