Roles: add a system admin and lock down the user and API-key endpoints #3

New Issue

2026-09-20T05:58:43Z

niklas commented

2026-09-20 05:58:43 +00:00

Part of #1. Depends on the Postgres move.

Today

There are no roles. Every authenticated caller can create and delete users, set anyone's password and mint API keys — internal/api/users.go and auth.go say so in a comment ("open to any authenticated caller"). The only gate is AuthMiddleware (internal/api/middleware.go), which accepts a session cookie or a Bearer API key.

Scope

Add is_admin (or a role column) to users, with a migration.
POST /api/bootstrap creates the first user as an admin.
An AdminOnly middleware, alongside the existing AuthMiddleware.
Gate behind it: create user, delete user, set another user's password, grant or revoke admin, and minting API keys.
Leave self-service alone: a user still changes their own password and their own ntfy topic.
The last admin cannot be deleted or demoted.
The web UI hides admin-only actions for non-admins, and the API enforces it regardless.
Tests: a non-admin gets 403 on each gated endpoint.

Notes

Team roles (owner/member) are a separate thing and arrive with teams. This issue is only the system-wide admin.

Done when

A non-admin user cannot create users or API keys through the API, the existing admin keeps working, and the migration marks the current users appropriately (probably all of them, since everyone has these powers today — decide explicitly).

Part of #1. Depends on the Postgres move. ### Today There are no roles. Every authenticated caller can create and delete users, set anyone's password and mint API keys — `internal/api/users.go` and `auth.go` say so in a comment ("open to any authenticated caller"). The only gate is `AuthMiddleware` (`internal/api/middleware.go`), which accepts a session cookie or a Bearer API key. ### Scope - [ ] Add `is_admin` (or a role column) to `users`, with a migration. - [ ] `POST /api/bootstrap` creates the first user as an admin. - [ ] An `AdminOnly` middleware, alongside the existing `AuthMiddleware`. - [ ] Gate behind it: create user, delete user, set another user's password, grant or revoke admin, and minting API keys. - [ ] Leave self-service alone: a user still changes their own password and their own ntfy topic. - [ ] The last admin cannot be deleted or demoted. - [ ] The web UI hides admin-only actions for non-admins, and the API enforces it regardless. - [ ] Tests: a non-admin gets 403 on each gated endpoint. ### Notes Team roles (`owner`/`member`) are a separate thing and arrive with teams. This issue is only the system-wide admin. ### Done when A non-admin user cannot create users or API keys through the API, the existing admin keeps working, and the migration marks the current users appropriately (probably all of them, since everyone has these powers today — decide explicitly).

niklas referenced this issue

2026-09-20 05:59:55 +00:00

Epic: teams, escalation chains, self-service onboarding and an admin page #1

niklas added the auth label 2026-09-20 06:13:00 +00:00

niklas referenced a pull request that will close this issue

2026-09-20 11:20:22 +00:00

Add a system administrator role, and gate account management behind it #10

niklas closed this issue

2026-09-20 13:10:48 +00:00

niklas referenced this issue from a commit

2026-09-21 13:51:28 +00:00

Let people set their own ntfy topic under Account