Skip to content

Add UI route authorization and decouple admin routes #918

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jescalada opened this issue Feb 21, 2025 · 0 comments · May be fixed by #917 or #961
Open

Add UI route authorization and decouple admin routes #918

jescalada opened this issue Feb 21, 2025 · 0 comments · May be fixed by #917 or #961
Assignees

Comments

@jescalada
Copy link
Contributor

Is your feature request related to a problem? Please describe.
To improve security and make access more granular, we'd like to add authorization to UI routes. In other words, we want users to log in if they wish to access any route. Furthermore, only admins should be able to see certain resources (such as the list of users and their details, changing a user's admin status, and so on).

Currently, even unlogged users can see the list of users, access admin routes, etc. We're not sure if this is by design, but we feel it would help to make access more strict.

Describe the solution you'd like
A basic frontend route guard could check a user's auth and admin status and redirect them accordingly (to the login page, "unauthorized" page, or actual page).

Describe alternatives you've considered
None

Additional context
Our biggest concern is how our route changes will affect current users. Are users currently using git-proxy without logging in or distinguishing between admins and non-admins?

Our changes may affect their current workflow, so ideally we want to make things as intuitive as possible and back them up with documentation so they can keep using the library as usual.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment