From de12c862b3f4e69290c8e93b3b4520024ba458f6 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 7 Nov 2026 22:35:09 +0100
Subject: access: the users endpoints

/admin/users: list, add (one or several), remove, disable, grant and
revoke capabilities; each one change, refused if it would lock its
writer out. Capabilities as the store's paths name them.

Auth plan M1.
---
 src/api/mod.rs | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

(limited to 'src/api/mod.rs')

diff --git a/src/api/mod.rs b/src/api/mod.rs
index 3e944dc..03b4fdd 100644
--- a/src/api/mod.rs
+++ b/src/api/mod.rs
@@ -15,6 +15,7 @@ mod log;
 mod peers;
 mod stats;
 mod store;
+mod users;
 
 use axum::{
     Json, Router,
@@ -61,6 +62,20 @@ pub(crate) fn router(state: AppState, auth_state: AuthState, debug_api: bool) ->
         .route("/admin/changes", get(changes::get_changes))
         .route("/admin/changes/{*key}", get(changes::get_changes_at))
         .route("/admin/config", get(config::get_config))
+        .route("/admin/users", get(users::list).post(users::add_several))
+        .route(
+            "/admin/users/{name}",
+            get(users::get).post(users::add).delete(users::remove),
+        )
+        .route(
+            "/admin/users/{name}/disabled",
+            axum::routing::put(users::set_disabled),
+        )
+        .route(
+            "/admin/users/{name}/caps",
+            axum::routing::post(users::grant),
+        )
+        .route("/admin/users/{name}/caps/{id}", delete(users::revoke))
         .merge(crate::remake::router::<AppState>());
 
     #[cfg(feature = "dashboard")]
-- 
cgit v1.3.1