Merge 31bc244ee4 into 9611a7f976

Cargo.lock

@@ -3006,6 +3006,7 @@ dependencies = [
  "sshkey-attest",
  "sshkeys",
  "time",
+ "tracing",
  "url",
  "urlencoding",
  "utoipa",

proto/Cargo.toml

@@ -38,6 +38,7 @@ uuid = { workspace = true, features = ["serde"] }
 webauthn-rs-proto = { workspace = true }
 sshkey-attest = { workspace = true }
 sshkeys = { workspace = true }
+tracing = { workspace = true }
 
 [dev-dependencies]
 enum-iterator = { workspace = true }

proto/src/scim_v1/server.rs

@@ -4,11 +4,12 @@ use super::ScimSshPublicKey;
 use crate::attribute::Attribute;
 use crate::internal::UiHint;
 use scim_proto::ScimEntryHeader;
-use serde::Serialize;
+use serde::{Deserialize, Serialize};
 use serde_with::{base64, formats, hex::Hex, serde_as, skip_serializing_none};
 use std::collections::{BTreeMap, BTreeSet};
 use time::format_description::well_known::Rfc3339;
 use time::OffsetDateTime;
+use tracing::debug;
 use url::Url;
 use utoipa::ToSchema;
 use uuid::Uuid;
@@ -28,7 +29,7 @@ pub struct ScimEntryKanidm {
     pub attrs: BTreeMap<Attribute, ScimValueKanidm>,
 }
 
-#[derive(Serialize, Debug, Clone, ToSchema)]
+#[derive(Serialize, Deserialize, Debug, Clone, ToSchema)]
 pub enum ScimAttributeEffectiveAccess {
     /// All attributes on the entry have this permission granted
     Grant,
@@ -49,7 +50,7 @@ impl ScimAttributeEffectiveAccess {
     }
 }
 
-#[derive(Serialize, Debug, Clone, ToSchema)]
+#[derive(Serialize, Deserialize, Debug, Clone, ToSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct ScimEffectiveAccess {
     /// The identity that inherits the effective permission
@@ -209,7 +210,7 @@ pub struct ScimOAuth2ClaimMap {
     pub values: BTreeSet<String>,
 }
 
-#[derive(Serialize, Debug, Clone, PartialEq, Eq, ToSchema)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, ToSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct ScimReference {
     pub uuid: Uuid,
@@ -257,6 +258,92 @@ pub enum ScimValueKanidm {
     UiHints(Vec<UiHint>),
 }
 
+#[serde_as]
+#[derive(Serialize, Deserialize, Debug, Clone, ToSchema)]
+pub struct ScimPerson {
+    pub uuid: Uuid,
+    pub name: String,
+    pub displayname: Option<String>,
+    pub spn: String,
+    pub description: Option<String>,
+    pub mails: Vec<ScimMail>,
+    pub managed_by: Option<ScimReference>,
+    pub groups: Vec<ScimReference>,
+}
+
+impl TryFrom<ScimEntryKanidm> for ScimPerson {
+    type Error = ();
+
+    fn try_from(scim_entry: ScimEntryKanidm) -> Result<Self, Self::Error> {
+        let attr_str = |attr: &Attribute| -> Option<&str> {
+            match scim_entry.attrs.get(attr) {
+                Some(ScimValueKanidm::String(inner_string)) => Some(inner_string.as_str()),
+                Some(sv) => {
+                    debug!("SCIM entry had the {} attribute but it was not a ScimValueKanidm::String type, actual: {:?}", attr, sv);
+                    None
+                }
+                None => None,
+            }
+        };
+
+        let attr_mails = || -> Option<&Vec<ScimMail>> {
+            match scim_entry.attrs.get(&Attribute::Mail) {
+                Some(ScimValueKanidm::Mail(inner_string)) => Some(inner_string),
+                Some(sv) => {
+                    debug!("SCIM entry had the {} attribute but it was not a ScimValueKanidm::Mail type, actual: {:?}", Attribute::Mail, sv);
+                    None
+                }
+                None => None,
+            }
+        };
+
+        let attr_reference = |attr: &Attribute| -> Option<&ScimReference> {
+            match scim_entry.attrs.get(attr) {
+                Some(ScimValueKanidm::EntryReference(refer)) => Some(refer),
+                Some(sv) => {
+                    debug!("SCIM entry had the {} attribute but it was not a ScimValueKanidm::ScimReference type, actual: {:?}", attr, sv);
+                    None
+                }
+                None => None,
+            }
+        };
+
+        let attr_references = |attr: &Attribute| -> Option<&Vec<ScimReference>> {
+            match scim_entry.attrs.get(attr) {
+                Some(ScimValueKanidm::EntryReferences(refs)) => Some(refs),
+                Some(sv) => {
+                    debug!("SCIM entry had the {} attribute but it was not a ScimValueKanidm::EntryReferences type, actual: {:?}", attr, sv);
+                    None
+                }
+                None => None,
+            }
+        };
+
+        let uuid = scim_entry.header.id;
+        let name = attr_str(&Attribute::Name).ok_or(())?.to_string();
+        let displayname = attr_str(&Attribute::DisplayName).map(|s| s.to_string());
+        let spn = attr_str(&Attribute::Spn).ok_or(())?.to_string();
+        let description = attr_str(&Attribute::Description).map(|t| t.to_string());
+        let mails = attr_mails().cloned().unwrap_or_default();
+        let groups = attr_references(&Attribute::DirectMemberOf)
+            .cloned()
+            .unwrap_or(vec![]);
+
+        let managed_by = attr_reference(&Attribute::EntryManagedBy).cloned();
+
+        Ok(ScimPerson {
+            uuid,
+            name,
+            displayname,
+            spn,
+            description,
+            mails,
+            managed_by,
+            groups,
+        })
+    }
+}
+
 impl From<bool> for ScimValueKanidm {
     fn from(b: bool) -> Self {
         Self::Bool(b)

proto/src/v1/mod.rs

@@ -19,7 +19,7 @@ pub use self::auth::*;
 pub use self::unix::*;
 
 /// The type of Account in use.
-#[derive(Clone, Copy, Debug, ToSchema)]
+#[derive(Serialize, Deserialize, Clone, Copy, Debug, ToSchema)]
 pub enum AccountType {
     Person,
     ServiceAccount,

server/core/src/actors/v1_scim.rs

@@ -7,6 +7,7 @@ use kanidmd_lib::idm::scim::{
 };
 use kanidmd_lib::idm::server::IdmServerTransaction;
 use kanidmd_lib::prelude::*;
+use std::collections::BTreeSet;
 
 impl QueryServerWriteV1 {
     #[instrument(
@@ -229,4 +230,35 @@ impl QueryServerReadV1 {
             .qs_read
             .scim_entry_id_get_ext(target_uuid, class, query, ident)
     }
+
+    #[instrument(
+        level = "info",
+        skip_all,
+        fields(uuid = ?eventid)
+    )]
+    pub async fn scim_entry_search(
+        &self,
+        client_auth_info: ClientAuthInfo,
+        filter_intent: Filter<FilterInvalid>,
+        eventid: Uuid,
+        attrs: Option<BTreeSet<Attribute>>,
+        acp: bool,
+    ) -> Result<Vec<ScimEntryKanidm>, OperationError> {
+        let ct = duration_from_epoch_now();
+        let mut idms_prox_read = self.idms.proxy_read().await?;
+        let ident = idms_prox_read
+            .validate_client_auth_info_to_ident(client_auth_info, ct)
+            .inspect_err(|err| {
+                error!(?err, "Invalid identity");
+            })?;
+
+        let filter = filter_all!(f_and!([f_eq(Attribute::Class, EntryClass::Account.into())]));
+
+        idms_prox_read
+            .qs_read
+            .impersonate_search_ext(filter_intent, filter, &ident, attrs, acp)?
+            .into_iter()
+            .map(|entry| entry.to_scim_kanidm(&mut idms_prox_read.qs_read))
+            .collect()
+    }
 }

server/core/src/https/views/admin/mod.rs

@@ -0,0 +1,19 @@
+use crate::https::ServerState;
+use axum::routing::get;
+use axum::Router;
+use axum_htmx::HxRequestGuardLayer;
+
+mod persons;
+
+pub fn admin_router() -> Router<ServerState> {
+    let unguarded_router = Router::new()
+        .route("/persons", get(persons::view_persons_get))
+        .route(
+            "/person/:person_uuid/view",
+            get(persons::view_person_view_get),
+        );
+
+    let guarded_router = Router::new().layer(HxRequestGuardLayer::new("/ui"));
+
+    Router::new().merge(unguarded_router).merge(guarded_router)
+}

server/core/src/https/views/admin/persons.rs

@@ -0,0 +1,185 @@
+use crate::https::extractors::{DomainInfo, VerifiedClientInformation};
+use crate::https::middleware::KOpId;
+use crate::https::views::errors::HtmxError;
+use crate::https::views::navbar::NavbarCtx;
+use crate::https::views::Urls;
+use crate::https::ServerState;
+use askama::Template;
+use axum::extract::{Path, State};
+use axum::http::Uri;
+use axum::response::{ErrorResponse, IntoResponse, Response};
+use axum::Extension;
+use axum_htmx::{HxPushUrl, HxRequest};
+use futures_util::TryFutureExt;
+use kanidm_proto::attribute::Attribute;
+use kanidm_proto::internal::OperationError;
+use kanidm_proto::scim_v1::server::{ScimEffectiveAccess, ScimEntryKanidm, ScimPerson};
+use kanidm_proto::scim_v1::ScimEntryGetQuery;
+use kanidmd_lib::constants::EntryClass;
+use kanidmd_lib::filter::{f_and, f_eq, Filter, FC};
+use kanidmd_lib::idm::server::DomainInfoRead;
+use kanidmd_lib::idm::ClientAuthInfo;
+use std::collections::BTreeSet;
+use std::str::FromStr;
+use uuid::Uuid;
+
+const PERSON_ATTRIBUTES: [Attribute; 9] = [
+    Attribute::Uuid,
+    Attribute::Description,
+    Attribute::Name,
+    Attribute::DisplayName,
+    Attribute::Spn,
+    Attribute::Mail,
+    Attribute::Class,
+    Attribute::EntryManagedBy,
+    Attribute::DirectMemberOf,
+];
+
+#[derive(Template)]
+#[template(path = "admin/admin_panel_template.html")]
+pub(crate) struct PersonsView {
+    navbar_ctx: NavbarCtx,
+    partial: PersonsPartialView,
+}
+
+#[derive(Template)]
+#[template(path = "admin/admin_persons_partial.html")]
+struct PersonsPartialView {
+    persons: Vec<(ScimPerson, ScimEffectiveAccess)>,
+}
+
+#[derive(Template)]
+#[template(path = "admin/admin_panel_template.html")]
+struct PersonView {
+    partial: PersonViewPartial,
+    navbar_ctx: NavbarCtx,
+}
+
+#[derive(Template)]
+#[template(path = "admin/admin_person_view_partial.html")]
+struct PersonViewPartial {
+    person: ScimPerson,
+    scim_effective_access: ScimEffectiveAccess,
+}
+
+pub(crate) async fn view_person_view_get(
+    State(state): State<ServerState>,
+    HxRequest(is_htmx): HxRequest,
+    Extension(kopid): Extension<KOpId>,
+    VerifiedClientInformation(client_auth_info): VerifiedClientInformation,
+    Path(uuid): Path<Uuid>,
+    DomainInfo(domain_info): DomainInfo,
+) -> axum::response::Result<Response> {
+    let (person, scim_effective_access) =
+        get_person_info(uuid, state, &kopid, client_auth_info, domain_info.clone()).await?;
+    let person_partial = PersonViewPartial {
+        person,
+        scim_effective_access,
+    };
+
+    let path_string = format!("/ui/admin/person/{uuid}/view");
+    let uri = Uri::from_str(path_string.as_str())
+        .map_err(|_| HtmxError::new(&kopid, OperationError::Backend, domain_info.clone()))?;
+    let push_url = HxPushUrl(uri);
+    Ok(if is_htmx {
+        (push_url, person_partial).into_response()
+    } else {
+        (
+            push_url,
+            PersonView {
+                partial: person_partial,
+                navbar_ctx: NavbarCtx { domain_info },
+            },
+        )
+            .into_response()
+    })
+}
+
+pub(crate) async fn view_persons_get(
+    State(state): State<ServerState>,
+    HxRequest(is_htmx): HxRequest,
+    Extension(kopid): Extension<KOpId>,
+    DomainInfo(domain_info): DomainInfo,
+    VerifiedClientInformation(client_auth_info): VerifiedClientInformation,
+) -> axum::response::Result<Response> {
+    let persons = get_persons_info(state, &kopid, client_auth_info, domain_info.clone()).await?;
+    let persons_partial = PersonsPartialView { persons: persons };
+
+    let push_url = HxPushUrl(Uri::from_static("/ui/admin/persons"));
+    Ok(if is_htmx {
+        (push_url, persons_partial).into_response()
+    } else {
+        (
+            push_url,
+            PersonsView {
+                navbar_ctx: NavbarCtx { domain_info },
+                partial: persons_partial,
+            },
+        )
+            .into_response()
+    })
+}
+
+async fn get_person_info(
+    uuid: Uuid,
+    state: ServerState,
+    kopid: &KOpId,
+    client_auth_info: ClientAuthInfo,
+    domain_info: DomainInfoRead,
+) -> Result<(ScimPerson, ScimEffectiveAccess), ErrorResponse> {
+    let scim_entry: ScimEntryKanidm = state
+        .qe_r_ref
+        .scim_entry_id_get(
+            client_auth_info.clone(),
+            kopid.eventid,
+            uuid.to_string(),
+            EntryClass::Person,
+            ScimEntryGetQuery {
+                attributes: Some(Vec::from(PERSON_ATTRIBUTES)),
+                ext_access_check: true,
+            },
+        )
+        .map_err(|op_err| HtmxError::new(kopid, op_err, domain_info.clone()))
+        .await?;
+
+    if let Some(personinfo_info) = scimentry_into_personinfo(scim_entry) {
+        Ok(personinfo_info)
+    } else {
+        Err(HtmxError::new(kopid, OperationError::InvalidState, domain_info.clone()).into())
+    }
+}
+
+async fn get_persons_info(
+    state: ServerState,
+    kopid: &KOpId,
+    client_auth_info: ClientAuthInfo,
+    domain_info: DomainInfoRead,
+) -> Result<Vec<(ScimPerson, ScimEffectiveAccess)>, ErrorResponse> {
+    let filter = filter_all!(f_and!([f_eq(Attribute::Class, EntryClass::Person.into())]));
+    let attrs = Some(BTreeSet::from(PERSON_ATTRIBUTES));
+    let base: Vec<ScimEntryKanidm> = state
+        .qe_r_ref
+        .scim_entry_search(client_auth_info.clone(), filter, kopid.eventid, attrs, true)
+        .map_err(|op_err| HtmxError::new(kopid, op_err, domain_info.clone()))
+        .await?;
+
+    // TODO: inefficient to sort here
+    let mut persons: Vec<_> = base
+        .into_iter()
+        // TODO: Filtering away unsuccessful entries may not be desired.
+        .filter_map(scimentry_into_personinfo)
+        .collect();
+
+    persons.sort_by_key(|(sp, _)| sp.uuid);
+    persons.reverse();
+    Ok(persons)
+}
+
+fn scimentry_into_personinfo(
+    scim_entry: ScimEntryKanidm,
+) -> Option<(ScimPerson, ScimEffectiveAccess)> {
+    let scim_effective_access = scim_entry.ext_access_check.clone()?; // TODO: This should be an error msg.
+    let person = ScimPerson::try_from(scim_entry).ok()?;
+
+    Some((person, scim_effective_access))
+}

server/core/src/https/views/apps.rs

@@ -45,14 +45,14 @@ pub(crate) async fn view_apps_get(
         .await
         .map_err(|old| HtmxError::new(&kopid, old, domain_info.clone()))?;
 
+    let apps_partial = AppsPartialView { apps: app_links };
+
     Ok({
-        (
-            HxPushUrl(Uri::from_static(Urls::Apps.as_ref())),
-            AppsView {
-                navbar_ctx: NavbarCtx { domain_info },
-                apps_partial: AppsPartialView { apps: app_links },
-            },
-        )
-            .into_response()
+        let apps_view = AppsView {
+            navbar_ctx: NavbarCtx { domain_info },
+
+            apps_partial,
+        };
+        (HxPushUrl(Uri::from_static(Urls::Apps.as_ref())), apps_view).into_response()
     })
 }

server/core/src/https/views/enrol.rs

@@ -105,6 +105,7 @@ pub(crate) async fn view_enrol_get(
 
     Ok(ProfileView {
         navbar_ctx: NavbarCtx { domain_info },
+
         profile_partial: EnrolDeviceView {
             menu_active_item: ProfileMenuItems::EnrolDevice,
             qr_code_svg,

server/core/src/https/views/errors.rs

@@ -1,6 +1,6 @@
 use axum::http::StatusCode;
 use axum::response::{IntoResponse, Redirect, Response};
-use axum_htmx::{HxReswap, HxRetarget, SwapOption};
+use axum_htmx::{HxEvent, HxResponseTrigger, HxReswap, HxRetarget, SwapOption};
 use kanidmd_lib::idm::server::DomainInfoRead;
 use utoipa::ToSchema;
 use uuid::Uuid;
@@ -8,7 +8,7 @@ use uuid::Uuid;
 use kanidm_proto::internal::OperationError;
 
 use crate::https::middleware::KOpId;
-use crate::https::views::UnrecoverableErrorView;
+use crate::https::views::{ErrorToastPartial, UnrecoverableErrorView};
 // #[derive(Template)]
 // #[template(path = "recoverable_error_partial.html")]
 // struct ErrorPartialView {
@@ -41,7 +41,23 @@ impl IntoResponse for HtmxError {
                     | OperationError::SessionExpired
                     | OperationError::InvalidSessionState => Redirect::to("/ui").into_response(),
                     OperationError::SystemProtectedObject | OperationError::AccessDenied => {
-                        (StatusCode::FORBIDDEN, body).into_response()
+                        let trigger = HxResponseTrigger::after_swap([HxEvent::new(
+                            "permissionDenied".to_string(),
+                        )]);
+                        (
+                            trigger,
+                            HxRetarget("main".to_string()),
+                            HxReswap(SwapOption::BeforeEnd),
+                            (
+                                StatusCode::FORBIDDEN,
+                                ErrorToastPartial {
+                                    err_code: inner,
+                                    operation_id: kopid,
+                                },
+                            )
+                                .into_response(),
+                        )
+                            .into_response()
                     }
                     OperationError::NoMatchingEntries => {
                         (StatusCode::NOT_FOUND, body).into_response()

server/core/src/https/views/mod.rs

@@ -8,6 +8,7 @@ use axum::{
 
 use axum_htmx::HxRequestGuardLayer;
 
+use crate::https::views::admin::admin_router;
 use constants::Urls;
 use kanidmd_lib::{
     idm::server::DomainInfoRead,
@@ -16,6 +17,7 @@ use kanidmd_lib::{
 
 use crate::https::ServerState;
 
+mod admin;
 mod apps;
 pub(crate) mod constants;
 mod cookies;
@@ -36,6 +38,13 @@ struct UnrecoverableErrorView {
     domain_info: DomainInfoRead,
 }
 
+#[derive(Template)]
+#[template(path = "admin/error_toast.html")]
+struct ErrorToastPartial {
+    err_code: OperationError,
+    operation_id: Uuid,
+}
+
 pub fn view_router() -> Router<ServerState> {
     let mut unguarded_router = Router::new()
         .route(
@@ -122,7 +131,11 @@ pub fn view_router() -> Router<ServerState> {
         .route("/api/cu_commit", post(reset::commit))
         .layer(HxRequestGuardLayer::new("/ui"));
 
-    Router::new().merge(unguarded_router).merge(guarded_router)
+    let admin_router = admin_router();
+    Router::new()
+        .merge(unguarded_router)
+        .merge(guarded_router)
+        .nest("/admin", admin_router)
 }
 
 /// Serde deserialization decorator to map empty Strings to None,

server/core/src/https/views/profile.rs

@@ -48,6 +48,7 @@ pub(crate) async fn view_profile_get(
 
     Ok(ProfileView {
         navbar_ctx: NavbarCtx { domain_info },
+
         profile_partial: ProfilePartialView {
             menu_active_item: ProfileMenuItems::UserProfile,
             can_rw,

server/core/static/style.css

@@ -20,6 +20,15 @@ body {
   max-width: 680px;
 }
 
+/*
+* Bootstrap 5.3 fix for input-group validation
+* :has checks that a child can be selected with the selector
+* + selects the next sibling.
+*/
+.was-validated .input-group:has(.form-control:invalid) + .invalid-feedback {
+  display: block !important;
+}
+
 /*
  * Sidebar
  */

server/core/templates/admin/admin_panel_template.html

@@ -0,0 +1,10 @@
+(% extends "base_htmx_with_nav.html" %)
+
+(% block title %)Admin Panel(% endblock %)
+
+(% block head %)
+(% endblock %)
+
+(% block main %)
+    (( partial|safe ))
+(% endblock %)

server/core/templates/admin/admin_partial_base.html

@@ -0,0 +1,19 @@
+<main class="container-xxl pb-5">
+    <div class="d-flex flex-sm-row flex-column">
+        <div class="list-group side-menu">
+            <a href="/ui/admin/persons" hx-target="#main" class="list-group-item list-group-item-action (% block persons_item_extra_classes%)(%endblock%)">
+                <img src="/pkg/img/icon-accounts.svg" alt="Persons" width="20" height="20">
+                Persons</a>
+            <a href="/ui/admin/groups" hx-target="#main" class="list-group-item list-group-item-action (% block groups_item_extra_classes%)(%endblock%)">
+                <img src="/pkg/img/icon-groups.svg" alt="Groups" width="20" height="20">
+                Groups (placeholder)</a>
+            <a href="/ui/admin/oauth2" hx-target="#main" class="list-group-item list-group-item-action (% block oauth2_item_extra_classes%)(%endblock%)">
+                <img src="/pkg/img/icon-oauth2.svg" alt="Oauth2" width="20" height="20">
+                Oauth2 (placeholder)</a>
+        </div>
+        <div id="settings-window" class="flex-grow-1 ps-sm-4 pt-sm-0 pt-4">
+            (% block admin_page %)
+            (% endblock %)
+        </div>
+    </div>
+</main>

server/core/templates/admin/admin_person_details_partial.html

@@ -0,0 +1,34 @@
+(% macro string_attr(dispname, name, value, editable, attribute) %)
+(% if scim_effective_access.search.check(attribute|as_ref) %)
+<div class="row mt-3">
+    <label for="person(( name ))" class="col-12 col-md-3 col-lg-2 col-form-label fw-bold py-0">(( dispname ))</label>
+    <div class="col-12 col-md-8 col-lg-6">
+        <input readonly class="form-control-plaintext py-0" id="person(( name ))" name="(( name ))" value="(( value ))">
+    </div>
+</div>
+(% endif %)
+(% endmacro %)
+
+<form hx-validate="true" hx-ext="bs-validation">
+    (% call string_attr("UUID", "uuid", person.uuid, false, Attribute::Uuid) %)
+    (% call string_attr("SPN", "spn", person.spn, false, Attribute::Spn) %)
+    (% call string_attr("Name", "name", person.name, true, Attribute::Name) %)
+
+    (% if let Some(displayname) = person.displayname %)
+        (% call string_attr("Displayname", "displayname", displayname, true, Attribute::DisplayName) %)
+    (% else %)
+        (% call string_attr("Displayname", "displayname", "none", true, Attribute::DisplayName) %)
+    (% endif %)
+
+    (% if let Some(description) = person.description %)
+        (% call string_attr("Description", "description", description, true, Attribute::Description) %)
+    (% else %)
+        (% call string_attr("Description", "description", "none", true, Attribute::Description) %)
+    (% endif %)
+
+    (% if let Some(entry_managed_by) = person.managed_by %)
+        (% call string_attr("Managed By", "managed_by", entry_managed_by.value, true, Attribute::EntryManagedBy) %)
+    (% else %)
+        (% call string_attr("Managed By", "managed_by", "none", true, Attribute::EntryManagedBy) %)
+    (% endif %)
+</form>

server/core/templates/admin/admin_person_view_partial.html

@@ -0,0 +1,57 @@
+(% extends "admin/admin_partial_base.html" %)
+
+(% block persons_item_extra_classes %)active(% endblock %)
+
+(% block admin_page %)
+<nav aria-label="breadcrumb">
+    <ol class="breadcrumb">
+        <li class="breadcrumb-item"><a href="/ui/admin/persons" hx-target="#main">persons Management</a></li>
+        <li class="breadcrumb-item active" aria-current="page">Viewing</li>
+    </ol>
+</nav>
+
+(% include "admin_person_details_partial.html" %)
+
+<hr>
+
+(% if scim_effective_access.search.check(Attribute::Mail|as_ref) %)
+<label class="mt-3 fw-bold">Emails</label>
+<form hx-validate="true" hx-ext="bs-validation">
+    (% if person.mails.len() == 0 %)
+    <p>There are no email addresses associated with this person.</p>
+    (% else %)
+    <ol class="list-group col-12 col-md-8 col-lg-6">
+        (% for mail in person.mails %)
+        <li id="personMail(( loop.index ))" class="list-group-item d-flex flex-row justify-content-between">
+            <div class="d-flex align-items-center">(( mail.value ))</div>
+            <div class="buttons float-end">
+            </div>
+        </li>
+        (% endfor %)
+    </ol>
+    (% endif %)
+</form>
+(% endif %)
+
+(% if scim_effective_access.search.check(Attribute::DirectMemberOf|as_ref) %)
+<label class="mt-3 fw-bold">DirectMemberOf</label>
+<form hx-validate="true" hx-ext="bs-validation">
+    (% if person.groups.len() == 0 %)
+    <p>There are no groups this person is a direct member of.</p>
+    (% else %)
+    <ol class="list-group col-12 col-md-8 col-lg-6">
+        (% for group in person.groups %)
+        <li id="personGroup(( loop.index ))" class="list-group-item d-flex flex-row justify-content-between">
+            <div class="d-flex align-items-center">(( group.value ))</div>
+            <div class="buttons float-end">
+            </div>
+        </li>
+        (% endfor %)
+    </ol>
+    (% endif %)
+</form>
+(% endif %)
+
+
+
+(% endblock %)

server/core/templates/admin/admin_persons_partial.html

@@ -0,0 +1,23 @@
+(% extends "admin/admin_partial_base.html" %)
+
+(% block persons_item_extra_classes %)active(% endblock %)
+
+(% block admin_page %)
+<nav aria-label="breadcrumb">
+    <ol class="breadcrumb">
+        <li class="breadcrumb-item active" aria-current="page">Person Management</li>
+    </ol>
+</nav>
+
+<ul class="list-group">
+    (% for (person, _) in persons %)
+    <li class="list-group-item d-flex flex-row justify-content-between">
+        <div class="d-flex align-items-center">
+            <a href="/ui/admin/person/(( person.uuid ))/view" hx-target="#main">(( person.name ))</a> <span class="text-secondary d-none d-lg-inline-block mx-4">(( person.uuid ))</span>
+        </div>
+        <div class="buttons float-end">
+        </div>
+    </li>
+    (% endfor %)
+</ul>
+(% endblock %)

server/core/templates/admin/error_toast.html

@@ -0,0 +1,12 @@
+<div class="toast-container position-fixed bottom-0 end-0 p-3">
+    <div id="permissionDeniedToast" class="toast" role="alert" aria-live="assertive" aria-atomic="true">
+        <div class="toast-header">
+            <strong class="me-auto">Error</strong>
+            <button type="button" class="btn-close" data-bs-dismiss="toast" aria-label="Close"></button>
+        </div>
+        <div class="toast-body">
+            (( err_code )).<br>
+            OpId: (( operation_id ))
+        </div>
+    </div>
+</div>

server/core/templates/admin/saved_toast.html

@@ -0,0 +1,11 @@
+<div class="toast-container position-fixed bottom-0 end-0 p-3">
+    <div id="savedToast" class="toast" role="alert" aria-live="assertive" aria-atomic="true">
+        <div class="toast-header">
+            <strong class="me-auto">Success</strong>
+            <button type="button" class="btn-close" data-bs-dismiss="toast" aria-label="Close"></button>
+        </div>
+        <div class="toast-body">
+            Saved.
+        </div>
+    </div>
+</div>

server/core/templates/base_htmx_with_nav.html

@@ -2,7 +2,9 @@
 
 (% block body %)
 	(% include "navbar.html" %)
+	<div id="main">
 	(% block main %)(% endblock %)
+	</div>
 	(% include "signout_modal.html" %)
 (% endblock %)
 

server/core/templates/navbar.html

@@ -1,4 +1,4 @@
-<nav class="navbar navbar-expand-md kanidm_navbar mb-4">
+<nav hx-boost="false" class="navbar navbar-expand-md kanidm_navbar mb-4">
     <div class="container-lg">
         <a class="navbar-brand d-flex align-items-center" href="/ui/apps">
             (% if navbar_ctx.domain_info.image().is_some() %)
@@ -39,4 +39,4 @@
             </ul>
         </div>
     </div>
-</nav>
+</nav>

server/lib/src/event.rs

@@ -244,13 +244,15 @@ impl SearchEvent {
         ident: &Identity,
         filter: Filter<FilterValid>,
         filter_orig: Filter<FilterValid>,
+        attrs: Option<BTreeSet<Attribute>>,
+        effective_access_check: bool,
     ) -> Self {
         SearchEvent {
             ident: Identity::from_impersonate(ident),
             filter,
             filter_orig,
-            attrs: None,
-            effective_access_check: false,
+            attrs,
+            effective_access_check,
         }
     }
 

server/lib/src/idm/applinks.rs

@@ -32,7 +32,7 @@ impl IdmServerProxyReadTransaction<'_> {
         // _ext reduces the entries based on access.
         let oauth2_related = self
             .qs_read
-            .impersonate_search_ext(f_executed, f_intent, ident)?;
+            .impersonate_search_ext(f_executed, f_intent, ident, None, false)?;
         trace!(?oauth2_related);
 
         // Aggregate results to a Vec of AppLink

server/lib/src/server/mod.rs

@@ -492,7 +492,7 @@ pub trait QueryServerTransaction<'a> {
         f_intent_valid: Filter<FilterValid>,
         event: &Identity,
     ) -> Result<Vec<Arc<EntrySealedCommitted>>, OperationError> {
-        let se = SearchEvent::new_impersonate(event, f_valid, f_intent_valid);
+        let se = SearchEvent::new_impersonate(event, f_valid, f_intent_valid, None, false);
         self.search(&se)
     }
 
@@ -502,8 +502,10 @@ pub trait QueryServerTransaction<'a> {
         f_valid: Filter<FilterValid>,
         f_intent_valid: Filter<FilterValid>,
         event: &Identity,
+        attrs: Option<BTreeSet<Attribute>>,
+        acp: bool,
     ) -> Result<Vec<Entry<EntryReduced, EntryCommitted>>, OperationError> {
-        let se = SearchEvent::new_impersonate(event, f_valid, f_intent_valid);
+        let se = SearchEvent::new_impersonate(event, f_valid, f_intent_valid, attrs, acp);
         self.search_ext(&se)
     }
 
@@ -529,6 +531,8 @@ pub trait QueryServerTransaction<'a> {
         filter: Filter<FilterInvalid>,
         filter_intent: Filter<FilterInvalid>,
         event: &Identity,
+        attrs: Option<BTreeSet<Attribute>>,
+        acp: bool,
     ) -> Result<Vec<Entry<EntryReduced, EntryCommitted>>, OperationError> {
         let f_valid = filter
             .validate(self.get_schema())
@@ -536,7 +540,7 @@ pub trait QueryServerTransaction<'a> {
         let f_intent_valid = filter_intent
             .validate(self.get_schema())
             .map_err(OperationError::SchemaViolation)?;
-        self.impersonate_search_ext_valid(f_valid, f_intent_valid, event)
+        self.impersonate_search_ext_valid(f_valid, f_intent_valid, event, attrs, acp)
     }
 
     /// Get a single entry by its UUID. This is used heavily for internal
@@ -609,7 +613,7 @@ pub trait QueryServerTransaction<'a> {
         let filter_intent = filter_all!(f_eq(Attribute::Uuid, PartialValue::Uuid(uuid)));
         let filter = filter!(f_eq(Attribute::Uuid, PartialValue::Uuid(uuid)));
 
-        let mut vs = self.impersonate_search_ext(filter, filter_intent, event)?;
+        let mut vs = self.impersonate_search_ext(filter, filter_intent, event, None, false)?;
         match vs.pop() {
             Some(entry) if vs.is_empty() => Ok(entry),
             _ => {