Changed concept User to Admin by charming-wicket-5502 · Pull Request #2 · Cosmian/authentication

charming-wicket-5502 · 2026-04-28T11:21:38Z

No description provided.

Copilot

Pull request overview

This PR renames the administrative “User” concept to “Admin” across the auth server, updating API routes, middleware, database schema, tests, and documentation to reflect the new terminology.

Changes:

Replace /users/* CRUD + realm-membership endpoints with /admins/* equivalents and introduce admin_endpoints.rs.
Rename auth middleware/extension extraction from UserAuth + user_from_request to AdminAuth + admin_from_request.
Rename persisted DB structures from user/user_realms to admin/admin_realms across SQLite/Postgres/MySQL implementations and update client/test/docs accordingly.

Reviewed changes

Copilot reviewed 29 out of 29 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
server/tests.md	Updates test plan section headings/endpoint paths for `/admins` (still contains outdated test names).
server/src/tests/super_admin_api.rs	Switches tests to `Admin` model and `admin` client calls (helper naming still says `test_user`).
server/src/tests/mod.rs	Renames test module from `user_api` to `admin_api`.
server/src/tests/admin_api.rs	Renames integration tests and client calls to `/admins` (some comments/messages still reference User/UserAuth).
server/src/server/endpoints/user_endpoints.rs	Removes legacy `/users` endpoint implementation.
server/src/server/endpoints/totp_endpoints.rs	Uses `admin_from_request` for realm-admin authorization checks.
server/src/server/endpoints/super_admins_endpoints.rs	Uses `admin_from_request` and updates log/error wording to admin terminology.
server/src/server/endpoints/realms_endpoints.rs	Uses `admin_from_request` for credential-management authorization.
server/src/server/endpoints/mod.rs	Exposes `admin_endpoints` and adds `admin_from_request` helper returning `Admin`.
server/src/server/endpoints/admin_endpoints.rs	New `/admins` CRUD + realm membership endpoints with exclusive-ownership checks.
server/src/server/auth_server.rs	Rewires scopes from `/users` to `/admins` and middleware from `UserAuth` to `AdminAuth`.
server/src/middleware/mod.rs	Renames exported middleware module to `admin_auth`.
server/src/middleware/admin_auth.rs	Renames middleware to load/inject `Admin` via `find_admins_by_auth_scheme`.
server/src/lib.rs	Re-exports `Admin` from models and removes `User` export.
server/src/database/trait.rs	Renames trait CRUD methods and lookup to `Admin` equivalents; bootstrap creates seeded admin via `create_admin`.
server/src/database/impls/sqlite.rs	Renames tables/joins/queries to `admin` + `admin_realms` (no migration path included).
server/src/database/impls/postgres.rs	Same as sqlite for Postgres schema and queries.
server/src/database/impls/mysql.rs	Same as sqlite for MySQL schema and queries.
server/documentation/two_factor_authentication.md	Updates terminology and code snippets from `User` to `Admin`.
server/documentation/index.md	Updates glossary/terminology to `Admin` (minor grammar issue remains).
server/documentation/client_library.md	Updates client guide to `Admin` APIs (TOC link + sample code issue remains).
server/documentation/authorization_and_administration.md	Updates authorization model docs to `Admin` (diagram still references UserAuth/User.realms).
server/documentation/authentication_flows.md	Updates terminology to `Admin` (diagrams still reference UserAuth/find_users_by_auth_scheme).
server/documentation/api_reference.md	Renames “User Administration” to “Admin Administration” and updates paths (role/status-code details still inconsistent with implementation).
server/authorization.md	Updates terminology to `Admin` (still references `find_users_by_auth_scheme`/`user_from_request`).
client/src/models/mod.rs	Exports `Admin` instead of `User`.
client/src/models/base.rs	Renames `User` struct to `Admin` and updates helper methods.
client/src/lib.rs	Re-exports `Admin` in public API.
client/src/client/auth_client.rs	Renames user-management methods/endpoints to admin equivalents (`/admins/*`).

Comments suppressed due to low confidence (4)

server/documentation/authorization_and_administration.md:91

The authorization decision-flow diagram still references UserAuth middleware and User.realms, but the implementation has been renamed to AdminAuth and Admin.realms. Please update the mermaid diagram text so it matches the current types and middleware.

```mermaid
flowchart TD
    A[Incoming request] --> B{Authenticated?\nUserAuth middleware}
    B -- No --> Z[HTTP 401 Unauthorized]
    B -- Yes --> C{Endpoint category}

    C -- "Super-admin-only\n/admin/realm POST|PUT|DELETE\n/admins GET\n/admin/userpass GET" --> D{is_super_admin?}
    D -- No --> E[HTTP 403 Forbidden]
    D -- Yes --> F[Proceed]

    C -- "Realm-scoped\n/realms/{realm}/…\n/admin/realm/{id} GET\n/sessions/…" --> G{"can_administer_realm\n(realm)?"}
    G -- No --> E
    G -- Yes --> F

    C -- "Admin CRUD\n/admins/admin POST|GET|PUT|DELETE" --> SA{is_super_admin?}
    SA -- Yes --> F
    SA -- No --> OWN{"target.realms non-empty\nAND all realms in target\nadministered by requester?"}
    OWN -- No --> E
    OWN -- Yes --> PUTCHECK{"PUT only:\nbody.realms non-empty\nAND all new realms\nadministered by requester?"}
    PUTCHECK -- No --> E
    PUTCHECK -- Yes --> F

    C -- "GET /admin/realms" --> H{is_super_admin?}
    H -- Yes --> I[Return all realms]
    H -- No --> J["Return only realms in\nUser.realms list"]

**server/src/tests/admin_api.rs:296**
* This section still refers to `/users/*` endpoints and an unauthenticated `list_users` call, but the test now exercises `/admins` via `list_admins_as_super_admin()`. Please update the docstring and assertion message to match the renamed endpoints/methods, otherwise failures will be confusing to interpret.
**server/src/tests/admin_api.rs:1147**
* This test’s comments still describe `UserAuth`/`find_users_by_auth_scheme` and `/users` endpoints, but the server now uses `AdminAuth`/`find_admins_by_auth_scheme` and `/admins`. Please update these comments to reflect the renamed middleware and routes so the security-property being asserted remains clear.
**server/src/tests/super_admin_api.rs:40**
* The helper is still named `test_user` but now constructs an `Admin`. Renaming it to `test_admin` (and updating nearby comments that say “User record”) would reduce confusion, especially since there is also a separate `admin_api` test module that already uses `test_admin`.

fn test_user(id: &str) -> Admin {
Admin {
id: id.to_string(),
realms: vec![],
userpass: None,
jwt: None,
fido2: None,
digital_credentials: None,
client_certificate: None,
totp_enabled: None,
totp_secret: None,
totp_auth_url: None,
}

</details>



---

💡 <a href="/Cosmian/authentication/new/main?filename=.github/instructions/*.instructions.md" class="Link--inTextBlock" target="_blank" rel="noopener noreferrer">Add Copilot custom instructions</a> for smarter, more guided reviews. <a href="https://docs.github.com/en/copilot/customizing-copilot/adding-repository-custom-instructions-for-github-copilot" class="Link--inTextBlock" target="_blank" rel="noopener noreferrer">Learn how to get started</a>.

Co-authored-by: Copilot <[email protected]>

Agent-Logs-Url: https://github.com/Cosmian/authentication/sessions/5bb7aaa9-c013-48cf-b449-f89707cdb61f Co-authored-by: charming-wicket-5502 <[email protected]>

Manuthor · 2026-05-19T10:31:20Z

 description = "API Server"

 [features]
 default = ["openssl", "database"]


Build the admin-ui by default.

default = ["openssl", "database", "admin-ui"]

Manuthor · 2026-05-19T10:33:34Z

@@ -1,2 +1,2 @@
 [workspace.package]
 version = "1.0.0"


I would rather keep it in 0.1.0 the time we are doing tests on it. It must have other 1.0.0 versions to be changed too.

Suggested change

version = "0.1.0"

Also, IMHO the UI package.json should be align with the workspace Cargo.toml version

fmontaigne · 2026-05-20T10:53:38Z

+            }
+            onSuccess();
+        } catch {
+            // validation errors shown inline


Api errors are not handled on the form.
Also I don't see the messages (success) when testing in the UI

fmontaigne

Suggestions

Use tanstack query or similar to isolate API interaction logic and handle loading and error states
Be careful when using the "&&"" shortcut for conditional rendering as it can lead to strange renders in bad cases. Easy workaround it to cast the condition to a boolean with !! for example
Current tests are broken on my local installation at least (18 failed)
Some MD files probably needs to be removed or cleaned

fmontaigne · 2026-05-20T10:57:27Z

+                        <Space direction="vertical" className="w-full mb-4">
+                            <div className="p-4 bg-white rounded text-center">
+                                <img
+                                    src={`https://api.qrserver.com/v1/create-qr-code/?size=200x200&data=${encodeURIComponent(totpData.otpauth_url)}`}


Call to an external server to display the QR code of the TOPT secret. I guess it can cause security issues / unavailability issues. We should use a generator lib

fmontaigne · 2026-05-20T11:08:01Z

+            await onSubmit(passwordBytes);
+            form.resetFields();
+        } catch {
+            // validation errors are shown inline


Server errors are not shown

fmontaigne · 2026-05-20T11:12:16Z

+                        zIndex: 900,
+                        backgroundColor: isDarkMode ? "#3b0a0a" : "#fff1f0",
+                        borderColor: isDarkMode ? "#ff4d4f" : "#ff675f",
+                        color: isDarkMode ? "#ffb3b0" : "#a8071a",


Colors should be imported

fmontaigne · 2026-05-20T11:33:40Z

+        api.list(realmId)
+            .then(setCredentials)
+            .catch(() => {
+                /* shown inline below */


fmontaigne · 2026-05-20T11:33:50Z

+    const handleResetPassword = async (password: number[]) => {
+        if (!resetTarget) return;
+        const api = createCredentialsApi(serverUrl);
+        await api.update(realmId, resetTarget.username, { ...resetTarget, password });


no error handling

fmontaigne · 2026-05-20T11:45:19Z

+                itemName={realmLabel(selectedRealm)}
+                onConfirm={handleRevokeAll}
+                onCancel={() => setRevokeModalOpen(false)}
+                loading={false}


Should be removed or plugged in to the loading state

fmontaigne · 2026-05-20T11:47:47Z

+    return handleResponse<T>(response);
+}
+
+export async function apiDelete(baseUrl: string, path: string): Promise<void> {


fmontaigne · 2026-05-20T11:51:55Z

+export const realmTotpVerifyPath = (realmId: string): string => `/realms/${encodeURIComponent(realmId)}/totp/verify`;
+export const realmTotpUserPath = (realmId: string, username: string): string =>
+    `/realms/${encodeURIComponent(realmId)}/totp/${encodeURIComponent(username)}`;
+


Several exported paths are not used

fmontaigne · 2026-05-20T11:54:04Z

+}
+
+/** Session data */
+export interface SessionData {


Not used yet?

fmontaigne · 2026-05-20T11:56:10Z

+
+    tokens: {
+        light: {
+            colorPrimary: "#e34319",


Default colors must be in one place only, some are also in the Theme. This should be merged and exported

Changed concept User to Admin

548c9c0

charming-wicket-5502 requested a review from Copilot April 28, 2026 11:21

Copilot started reviewing on behalf of charming-wicket-5502 April 28, 2026 11:22 View session

Copilot AI reviewed Apr 28, 2026

View reviewed changes

charming-wicket-5502 and others added 4 commits April 28, 2026 15:52

Update server/documentation/authentication_flows.md

b6fbb3e

Co-authored-by: Copilot <[email protected]>

Update server/documentation/authentication_flows.md

c7d0648

Co-authored-by: Copilot <[email protected]>

Update server/documentation/client_library.md

a189a6e

Co-authored-by: Copilot <[email protected]>

Update server/documentation/client_library.md

45295da

Co-authored-by: Copilot <[email protected]>

charming-wicket-5502 self-assigned this Apr 28, 2026

charming-wicket-5502 added 15 commits April 29, 2026 09:16

Reworked REST API to ease simplify paths and align with standards

df357f2

Aligned documentation with API changes

5c7b527

fixed client endpoints that were incorrectly calling endpoints

ff88388

fixes to inconsistency in API variables naming schemes

bdbccf1

OpenAPI schema first draft

794cba2

Added swagger UI endpoint to visualize API

0ac61a7

Generation test

9e91564

Theme tweak

1518385

Server questions

148068e

Moved styling out of App.tsx

57eb337

darktheme tweaks

736e8dd

Aligned documentation with API changes

d4e546c

Realigned UI with reworked backend concepts

0f15d28

Realm management page first draft

5151769

Tests improvement

0f848da

charming-wicket-5502 requested review from Manuthor and bgrieder May 7, 2026 08:07

charming-wicket-5502 added 2 commits May 7, 2026 10:11

copilot instructions update

5e0cff8

Fixed pipeline formating and agent files cleanup

2961b51

Manuthor reviewed May 10, 2026

View reviewed changes

Comment thread admin-ui/package.json Outdated

Comment thread admin-ui/package.json Outdated

Comment thread admin-ui/public/mockServiceWorker.js Outdated

Comment thread admin-ui/public/mockServiceWorker.js Outdated

Manuthor reviewed May 10, 2026

View reviewed changes

Comment thread server/documentation/authorization_and_administration.md

charming-wicket-5502 added 13 commits May 12, 2026 13:39

UI Milestone

b67eebe

Fixed infinite loop in credentials

957d2db

Changes for non-mocked dev-mode

0409f14

UI fixes

93a9483

UI fixes

b2f8307

Serve UI from backend

3ab2953

formating fix for pipeline

ef9f358

Added branding.json

1ee9312

Added dedicated Github workflow for frontend testing

f16874f

fix mermaid diagram

7d7a583

formating

59bc833

removed mocks

9a76334

Admin form fix

35cf4bf

charming-wicket-5502 requested a review from fmontaigne May 18, 2026 13:19

Copilot started work on behalf of charming-wicket-5502 May 18, 2026 13:28 View session

fix admin-ui lint workflow install failure

5a45232

Agent-Logs-Url: https://github.com/Cosmian/authentication/sessions/5bb7aaa9-c013-48cf-b449-f89707cdb61f Co-authored-by: charming-wicket-5502 <[email protected]>

Copilot finished work on behalf of charming-wicket-5502 May 18, 2026 13:46

Manuthor reviewed May 19, 2026

View reviewed changes

fmontaigne reviewed May 20, 2026

View reviewed changes

fmontaigne requested changes May 20, 2026

View reviewed changes

Conversation

charming-wicket-5502 commented Apr 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fmontaigne left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants