diff --git a/artwork/logo-login.svg b/artwork/logo-login.svg
new file mode 100644
index 000000000..1740e503d
--- /dev/null
+++ b/artwork/logo-login.svg
@@ -0,0 +1,219 @@
+
+
+
+
diff --git a/artwork/logo-square.svg b/artwork/logo-square.svg
index 37257597c..dca55c5f2 100644
--- a/artwork/logo-square.svg
+++ b/artwork/logo-square.svg
@@ -1,14 +1,17 @@
+
+
diff --git a/kanidm_book/src/accounts_and_groups.md b/kanidm_book/src/accounts_and_groups.md
index 070d2d1c6..5b4cfa5e1 100644
--- a/kanidm_book/src/accounts_and_groups.md
+++ b/kanidm_book/src/accounts_and_groups.md
@@ -27,24 +27,21 @@ and sensitive data), group management, and more.
## Recovering the Initial idm_admin Account
By default the idm_admin user has no password, and can not be accessed. You should recover it with the
-admin (system admin) account. We recommend the use of the "recover_account" functionality as it provides a high strength, random password.
+admin (system admin) account.
-
-
-
-
-
-
Warning: The server must not be running at this point, as it requires exclusive access to the database.
-
-
+{{#template
+ templates/kani-warning.md
+ text=Warning: The server must not be running at this point, as it requires exclusive access to the database.
+}}
+We recommend the use of the "recover_account" functionality as it provides a high strength, random password.
```shell
kanidmd recover_account -c /etc/kanidm/server.toml -n idm_admin
Successfully recovered account 'idm_admin' - password reset to -> j9YUv...
```
-To do this in Docker, you'll neeD to stop the existing container and run it with "bash" as the "command" argument, to get a shell, then run the `kanidmd` command above.
+To do this in Docker, you'll need to stop the existing container and run it with `bash` as the "command" argument, to get a shell, then run the `kanidmd` command above.
For example, if I'm using the developer image in my test environment:
diff --git a/kanidm_tools/src/cli/account.rs b/kanidm_tools/src/cli/account.rs
index 81092d08c..e626aa432 100644
--- a/kanidm_tools/src/cli/account.rs
+++ b/kanidm_tools/src/cli/account.rs
@@ -190,6 +190,7 @@ impl AccountOpt {
{
// TODO: JSON output for account person extend.
Ok(_) => {
+ result_output.status = kanidm_proto::messages::MessageStatus::Success;
result_output.result = format!(
"Successfully extended the user {}.",
aopt.aopts.account_id
diff --git a/kanidmd/score/src/https/manifest.rs b/kanidmd/score/src/https/manifest.rs
new file mode 100644
index 000000000..f4d271d66
--- /dev/null
+++ b/kanidmd/score/src/https/manifest.rs
@@ -0,0 +1,189 @@
+///! Builds a Progressive Web App Manifest page.
+// Thanks to the webmanifest crate for a lot of this code
+use crate::https::{AppState, RequestExtensions};
+use serde::{Deserialize, Serialize};
+
+/// The MIME type for `.webmanifest` files.
+const MIME_TYPE_MANIFEST: &str = "application/manifest+json";
+
+/// Create a new manifest builder.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Manifest<'s> {
+ name: &'s str,
+ short_name: &'s str,
+ start_url: &'s str,
+ #[serde(rename = "display")]
+ display_mode: DisplayMode,
+ background_color: &'s str,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ description: Option<&'s str>,
+ #[serde(rename = "dir")]
+ direction: Direction,
+ // direction: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ orientation: Option,
+ // orientation: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ lang: Option<&'s str>,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ scope: Option<&'s str>,
+ // #[serde(skip_serializing_if = "Option::is_none")]
+ theme_color: &'s str,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ prefer_related_applications: Option,
+ // #[serde(borrow)]
+ // #[serde(skip_serializing_if = "Option::is_none")]
+ icons: Vec,
+ // icons: Vec>,
+ // #[serde(borrow)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ related_applications: Option>,
+ // related_applications: Vec>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+struct ManifestIcon {
+ src: String,
+ #[serde(rename = "type")]
+ mime_type: String,
+ sizes: String,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ purpose: Option,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+enum Direction {
+ /// left-to-right
+ #[serde(rename = "ltr")]
+ Ltr,
+ /// right-to-left
+ #[serde(rename = "rtl")]
+ Rtl,
+ /// Hints to the browser to use the [Unicode bidirectional
+ /// algorithm](https://developer.mozilla.org/en-US/docs/Web/Localization/Unicode_Bidirectional_Text_Algorithm)
+ /// to make a best guess about the text's direction.
+ #[serde(rename = "auto")]
+ Auto,
+}
+
+/// Display modes from the Web app manifest definition
+///
+/// Ref: https://developer.mozilla.org/en-US/docs/Web/Manifest/display
+#[derive(Debug, Clone, Serialize, Deserialize)]
+enum DisplayMode {
+ /// All of the available display area is used and no user agent chrome is
+ /// shown.
+ #[serde(rename = "full-screen")]
+ FullScreen,
+ /// The application will look and feel like a standalone application. This can
+ /// include the application having a different window, its own icon in the
+ /// application launcher, etc. In this mode, the user agent will exclude UI
+ /// elements for controlling navigation, but can include other UI elements
+ /// such as a status bar.
+ #[serde(rename = "standalone")]
+ Standalone,
+ /// The application will look and feel like a standalone application, but will
+ /// have a minimal set of UI elements for controlling navigation. The elements
+ /// will vary by browser.
+ #[serde(rename = "minimal-ui")]
+ MinimalUi,
+ /// The application opens in a conventional browser tab or new window,
+ /// depending on the browser and platform. This is the default.
+ #[serde(rename = "browser")]
+ Browser,
+}
+
+/// Generates a manifest.json file for progressive web app usag
+pub async fn manifest(req: tide::Request) -> tide::Result {
+ let mut res = tide::Response::new(200);
+ let (eventid, _) = req.new_eventid();
+ let domain_display_name = req.state().qe_r_ref.get_domain_display_name(eventid).await;
+
+ let icons = vec![
+ ManifestIcon {
+ sizes: String::from("512x512"),
+ src: String::from("/pkg/img/logo-square.svg"),
+ mime_type: String::from("image/svg+xml"),
+ purpose: None,
+ },
+ ManifestIcon {
+ sizes: String::from("512x512"),
+ src: String::from("/pkg/img/logo-512.png"),
+ mime_type: String::from("image/png"),
+ purpose: Some(String::from("maskable")),
+ },
+ ManifestIcon {
+ sizes: String::from("192x192"),
+ src: String::from("/pkg/img/logo-192.png"),
+ mime_type: String::from("image/png"),
+ purpose: Some(String::from("maskable")),
+ },
+ ManifestIcon {
+ sizes: String::from("256x156"),
+ src: String::from("/pkg/img/logo-256.png"),
+ mime_type: String::from("image/png"),
+ purpose: Some(String::from("maskable")),
+ },
+ ];
+
+
+ let manifest_struct = Manifest {
+ short_name: domain_display_name.as_str(),
+ name: domain_display_name.as_str(),
+ start_url: "/", // TODO: this needs to be the frontend URL, can't get this yet
+ display_mode: DisplayMode::MinimalUi,
+ description: None,
+ orientation: None,
+ lang: Some("en"),
+ theme_color: "white",
+ background_color: "white",
+ direction: Direction::Auto,
+ scope: None,
+ prefer_related_applications: None,
+ icons,
+ related_applications: None,
+ };
+
+ let manifest_string = serde_json::to_string_pretty(&manifest_struct)?;
+
+ res.set_content_type(MIME_TYPE_MANIFEST);
+ res.set_body(manifest_string);
+
+ Ok(res)
+}
+
+// "start_url": "/?source=pwa",
+// "background_color": "#3367D6",
+// "display": "standalone",
+// "scope": "/",
+// "theme_color": "#3367D6",
+// "shortcuts": [
+// {
+// "name": "How's weather today?",
+// "short_name": "Today",
+// "description": "View weather information for today",
+// "url": "/today?source=pwa",
+// "icons": [{ "src": "/images/today.png", "sizes": "192x192" }]
+// },
+// {
+// "name": "How's weather tomorrow?",
+// "short_name": "Tomorrow",
+// "description": "View weather information for tomorrow",
+// "url": "/tomorrow?source=pwa",
+// "icons": [{ "src": "/images/tomorrow.png", "sizes": "192x192" }]
+// }
+// ],
+// "description": "Weather forecast information",
+// "screenshots": [
+// {
+// "src": "/images/screenshot1.png",
+// "type": "image/png",
+// "sizes": "540x720"
+// },
+// {
+// "src": "/images/screenshot2.jpg",
+// "type": "image/jpg",
+// "sizes": "540x720"
+// }
+// ]
+// }
diff --git a/kanidmd/score/src/https/middleware.rs b/kanidmd/score/src/https/middleware.rs
index b024a7d69..643403b97 100644
--- a/kanidmd/score/src/https/middleware.rs
+++ b/kanidmd/score/src/https/middleware.rs
@@ -1,48 +1,7 @@
-///! Middleware for the tide web server
-
-//TODO: decide if this is still needed
-// #[derive(Default)]
-// /// Injects the domain_display_name where it needs to
-// pub struct KanidmDisplayNameMiddleware {
-// domain_display_name: String,
-// }
-
-// // // TODO: finish this for #860
-// // #[async_trait::async_trait]
-// // impl tide::Middleware for KanidmDisplayNameMiddleware {
-// // async fn handle(
-// // &self,
-// // request: tide::Request,
-// // next: tide::Next<'_, State>,
-// // ) -> tide::Result {
-// // let mut response = next.run(request).await;
-// // // grab the body we're intending to return at this point
-// // let body_str = response.take_body().into_string().await?;
-// // // update it with the hash
-// // // TODO: #860 make this a const so we can change it and not typo it later
-// // response.set_body(body_str.replace(
-// // "===DOMAIN_DISPLAY_NAME===",
-// // self.domain_display_name.as_str(),
-// // ));
-// // Ok(response)
-// // }
-// // }
-
-// impl KanidmDisplayNameMiddleware {
-// /// Pulls the domain_display_name from the qs on web server start, so we can
-// /// set it in pages
-// pub fn new(domain_display_name: String) -> Self {
-// KanidmDisplayNameMiddleware {
-// // TODO: #860 work out how to get this out :D
-// domain_display_name: domain_display_name,
-// }
-// }
-// }
-
#[derive(Default)]
/// This tide MiddleWare adds headers like Content-Security-Policy
/// and similar families. If it keeps adding more things then
-/// probably rename the middlewre :)
+/// probably rename the middleware :)
pub struct UIContentSecurityPolicyResponseMiddleware {
// The sha384 hash of /pkg/wasmloader.js
pub integrity_wasmloader: String,
diff --git a/kanidmd/score/src/https/mod.rs b/kanidmd/score/src/https/mod.rs
index b98613251..1d32915c5 100644
--- a/kanidmd/score/src/https/mod.rs
+++ b/kanidmd/score/src/https/mod.rs
@@ -1,30 +1,29 @@
+mod manifest;
mod middleware;
mod oauth2;
mod v1;
+use self::manifest::manifest;
use self::middleware::*;
use self::oauth2::*;
use self::v1::*;
+use compact_jwt::{Jws, JwsSigner, JwsUnverified, JwsValidator};
use kanidm::actors::v1_read::QueryServerReadV1;
use kanidm::actors::v1_write::QueryServerWriteV1;
use kanidm::config::{ServerRole, TlsConfiguration};
use kanidm::prelude::*;
use kanidm::status::StatusActor;
-
+use kanidm::tracing_tree::TreeMiddleware;
use regex::Regex;
use serde::Serialize;
use std::fs::canonicalize;
use std::path::PathBuf;
use std::str::FromStr;
-use uuid::Uuid;
-
-use kanidm::tracing_tree::TreeMiddleware;
use tide_compress::CompressMiddleware;
use tide_openssl::TlsListener;
use tracing::{error, info};
-
-use compact_jwt::{Jws, JwsSigner, JwsUnverified, JwsValidator};
+use uuid::Uuid;
#[derive(Clone)]
pub struct AppState {
@@ -183,36 +182,65 @@ pub fn to_tide_response(
})
}
-// Handle the various end points we need to expose
+/// Returns a generic robots.txt
+async fn robots_txt(_req: tide::Request) -> tide::Result {
+ let mut res = tide::Response::new(200);
+
+ res.set_content_type("text/plain");
+ res.set_body(
+ r#"
+User-agent: *
+Disallow: /
+"#,
+ );
+ Ok(res)
+}
+
+/// The web UI at / for Kanidm
async fn index_view(req: tide::Request) -> tide::Result {
+ let mut res = tide::Response::new(200);
let (eventid, hvalue) = req.new_eventid();
let domain_display_name = req.state().qe_r_ref.get_domain_display_name(eventid).await;
-
- let mut res = tide::Response::new(200);
res.insert_header("X-KANIDM-OPID", hvalue);
res.set_content_type("text/html;charset=utf-8");
-
res.set_body(format!(r#"
-
-
-
-
-
- {}
-
-
-
-
+
+
+
+
+
+
+ {}
-
-
-
-
-
- "#, domain_display_name.as_str())
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 
-