Ilker ManapandClaude Opus 5.5
b60cf45adf
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
31 lines
912 B
Go
31 lines
912 B
Go
package web
|
|
|
|
import (
|
|
"net/http"
|
|
)
|
|
|
|
// AdminPage wraps the dashboard in a session check for the public port.
|
|
//
|
|
// A visitor who is not an admin gets 404 rather than 403. 403 would confirm the
|
|
// page exists and that admin accounts are a thing here, which is free
|
|
// reconnaissance for anyone probing; 404 is what every other unknown path
|
|
// returns.
|
|
func (p *AccountPages) AdminPage(dashboard http.HandlerFunc) http.HandlerFunc {
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
noStore(w)
|
|
_, user, ok := p.session(r)
|
|
if !ok {
|
|
// Not signed in at all: send them to sign in, which is useful and
|
|
// reveals nothing — /login is public anyway.
|
|
http.Redirect(w, r, "/login", http.StatusSeeOther)
|
|
return
|
|
}
|
|
if !staffMay(user, r) {
|
|
http.NotFound(w, r)
|
|
return
|
|
}
|
|
p.log.Info("admin viewed the cluster", "user", user.ID, "email", user.Email)
|
|
dashboard(w, p.withNav(r, user))
|
|
}
|
|
}
|