linus/KC-APP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Authentik OIDC login (PKCE) + Leitungsteam admin screens

Browse Source 
Backend:
- AuthentikStrategy / TokenVerificationService: normalise the issuer's
  trailing slash and accept both `iss` spellings (Authentik's discovery
  issuer and token `iss` carry a trailing slash; the JWKS URL must not
  double it). Wire the real konfi-castle issuer into .env.example.
- team token path now goes through toAuthenticatedUser too, so a local
  account flagged isLeitungsteam gets the synthetic global LT membership
  regardless of token kind.
- LT-admin controllers (kc, gemeinde, onboarding, sync, teamer) accept
  ['authentik','team'] so such an account can use them. RolesGuard still
  enforces the actual LT/role check.
- app.module serves the Flutter web build from client/app/build/web (SPA
  fallback covers the OIDC redirect path /v1/auth/callback), falling back
  to the interim client/web/ if it isn't built.

Client (client/app/):
- oidc.dart: Authorization-Code + PKCE against Authentik (discovery, S256
  challenge, state, token exchange, refresh). Browser bits (sessionStorage,
  redirect, URL) behind a conditional import so `flutter test` still
  compiles on the VM.
- AppState handles the ?code= callback on bootstrap, stores access +
  refresh, refreshes an expired token on restart.
- Login screen: "Mit Konfi-Castle-ID anmelden" button (Leitungsteam /
  Verantwortliche) alongside the local Teamer password form.
- admin_screen.dart: LT-only "Verwaltung" — list/create KCs, per KC the
  Gemeinden (list/create) and pending Verantwortlichen requests
  (approve/reject). Verified end to end against local Postgres with an
  isLeitungsteam account (create KC/Gemeinde, list + approve a request).

flutter analyze/test/build web green; backend npm test 56.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
linus
2026-09-10 09:24:38 +02:00
co-authored by Claude Sonnet 5
parent d5ecdcd3c4
commit df11d8492d
20 changed files with 693 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/app/lib/screens/admin_screen.dart
+291
View File
@@ -0,0 +1,291 @@
import 'package:flutter/material.dart';
import '../api.dart';
import '../main.dart';
/// Leitungsteam admin: KCs, their Gemeinden, and pending self-registrations.
class AdminScreen extends StatefulWidget {
const AdminScreen({super.key});
@override
State<AdminScreen> createState() => _AdminScreenState();
}
class _AdminScreenState extends State<AdminScreen> {
Future<List<Kc>>? _future;
@override
void didChangeDependencies() {
super.didChangeDependencies();
_future ??= AppScope.of(context).api.kcs();
}
void _reload() => setState(() => _future = AppScope.of(context).api.kcs());
Future<void> _createKc() async {
final api = AppScope.of(context).api;
final name = await _promptText(context, 'Neues KC', 'Name');
if (name == null || name.isEmpty || !mounted) return;
try {
await api.createKc(name);
if (mounted) _reload();
} catch (e) {
if (mounted) _toast(context, '$e');
}
}
@override
Widget build(BuildContext context) {
return Scaffold(
appBar: AppBar(title: const Text('Verwaltung')),
floatingActionButton: FloatingActionButton.extended(
onPressed: _createKc,
icon: const Icon(Icons.add),
label: const Text('KC'),
),
body: FutureBuilder<List<Kc>>(
future: _future,
builder: (context, snap) {
if (snap.connectionState != ConnectionState.done) {
return const Center(child: CircularProgressIndicator());
}
if (snap.hasError) {
return Center(
child: Padding(
padding: const EdgeInsets.all(24),
child: Text('${snap.error}', textAlign: TextAlign.center),
),
);
}
final kcs = snap.data!;
if (kcs.isEmpty) {
return const Center(child: Text('Noch keine KCs. Unten anlegen.'));
}
return ListView(
children: [
for (final kc in kcs)
ListTile(
leading: const Icon(Icons.festival),
title: Text(kc.name),
subtitle: Text('Code ${kc.inviteCode}'),
trailing: const Icon(Icons.chevron_right),
onTap: () => Navigator.of(context).push(
MaterialPageRoute(builder: (_) => KcDetailScreen(kc: kc)),
),
),
],
);
},
),
);
}
}
class KcDetailScreen extends StatefulWidget {
const KcDetailScreen({super.key, required this.kc});
final Kc kc;
@override
State<KcDetailScreen> createState() => _KcDetailScreenState();
}
class _KcDetailScreenState extends State<KcDetailScreen> {
Future<List<Gemeinde>>? _gemeinden;
Future<List<OnboardingRequest>>? _requests;
Api get _api => AppScope.of(context).api;
@override
void didChangeDependencies() {
super.didChangeDependencies();
_gemeinden ??= _api.gemeinden(widget.kc.id);
_requests ??= _api.onboardingRequests(widget.kc.id);
}
void _reloadGemeinden() =>
setState(() => _gemeinden = _api.gemeinden(widget.kc.id));
void _reloadRequests() =>
setState(() => _requests = _api.onboardingRequests(widget.kc.id));
Future<void> _addGemeinde() async {
final api = _api;
final name = await _promptText(context, 'Neue Gemeinde', 'Name');
if (name == null || name.isEmpty || !mounted) return;
try {
await api.createGemeinde(widget.kc.id, name);
if (mounted) _reloadGemeinden();
} catch (e) {
if (mounted) _toast(context, '$e');
}
}
@override
Widget build(BuildContext context) {
return Scaffold(
appBar: AppBar(title: Text(widget.kc.name)),
body: ListView(
padding: const EdgeInsets.all(16),
children: [
Card(
child: ListTile(
title: const Text('Einladungscode'),
subtitle: Text(widget.kc.inviteCode),
trailing: const Icon(Icons.qr_code_2),
),
),
const SizedBox(height: 16),
Row(
children: [
Expanded(
child: Text('Gemeinden',
style: Theme.of(context).textTheme.titleMedium),
),
TextButton.icon(
onPressed: _addGemeinde,
icon: const Icon(Icons.add),
label: const Text('Hinzufügen'),
),
],
),
_GemeindeList(future: _gemeinden!, onRetry: _reloadGemeinden),
const Divider(height: 40),
Text('Offene Verantwortlichen-Anfragen',
style: Theme.of(context).textTheme.titleMedium),
const SizedBox(height: 8),
_RequestList(
future: _requests!,
onAction: (id, approve) async {
try {
approve
? await _api.approveOnboarding(id)
: await _api.rejectOnboarding(id);
_reloadRequests();
} catch (e) {
if (context.mounted) _toast(context, '$e');
}
},
),
],
),
);
}
}
class _GemeindeList extends StatelessWidget {
const _GemeindeList({required this.future, required this.onRetry});
final Future<List<Gemeinde>> future;
final VoidCallback onRetry;
@override
Widget build(BuildContext context) {
return FutureBuilder<List<Gemeinde>>(
future: future,
builder: (context, snap) {
if (snap.connectionState != ConnectionState.done) {
return const Padding(
padding: EdgeInsets.all(12),
child: Center(child: CircularProgressIndicator()),
);
}
if (snap.hasError) {
return TextButton(onPressed: onRetry, child: Text('Fehler: ${snap.error}'));
}
final gemeinden = snap.data!;
if (gemeinden.isEmpty) return const Text('Noch keine Gemeinden.');
return Column(
children: [
for (final g in gemeinden)
ListTile(
dense: true,
leading: const Icon(Icons.church),
title: Text(g.name),
),
],
);
},
);
}
}
class _RequestList extends StatelessWidget {
const _RequestList({required this.future, required this.onAction});
final Future<List<OnboardingRequest>> future;
final Future<void> Function(String id, bool approve) onAction;
@override
Widget build(BuildContext context) {
return FutureBuilder<List<OnboardingRequest>>(
future: future,
builder: (context, snap) {
if (snap.connectionState != ConnectionState.done) {
return const Padding(
padding: EdgeInsets.all(12),
child: Center(child: CircularProgressIndicator()),
);
}
if (snap.hasError) {
return Text('Fehler: ${snap.error}');
}
final requests = snap.data!;
if (requests.isEmpty) return const Text('Keine offenen Anfragen.');
return Column(
children: [
for (final r in requests)
Card(
child: ListTile(
title: Text(r.userName.isEmpty ? r.userEmail : r.userName),
subtitle: Text('${r.userEmail}\nGemeinde: ${r.gemeindeName}'),
isThreeLine: true,
trailing: Row(
mainAxisSize: MainAxisSize.min,
children: [
IconButton(
tooltip: 'Genehmigen',
icon: const Icon(Icons.check, color: Colors.green),
onPressed: () => onAction(r.id, true),
),
IconButton(
tooltip: 'Ablehnen',
icon: const Icon(Icons.close, color: Colors.red),
onPressed: () => onAction(r.id, false),
),
],
),
),
),
],
);
},
);
}
}
Future<String?> _promptText(BuildContext context, String title, String label) {
final controller = TextEditingController();
return showDialog<String>(
context: context,
builder: (context) => AlertDialog(
title: Text(title),
content: TextField(
controller: controller,
autofocus: true,
decoration: InputDecoration(labelText: label),
onSubmitted: (v) => Navigator.of(context).pop(v.trim()),
),
actions: [
TextButton(
onPressed: () => Navigator.of(context).pop(),
child: const Text('Abbrechen'),
),
FilledButton(
onPressed: () => Navigator.of(context).pop(controller.text.trim()),
child: const Text('OK'),
),
],
),
);
}
void _toast(BuildContext context, String message) {
ScaffoldMessenger.of(context).showSnackBar(SnackBar(content: Text(message)));
}
client/app/lib/screens/home_screen.dart
+8
View File
@@ -2,6 +2,7 @@ import 'package:flutter/material.dart';
import '../api.dart';
import '../main.dart';
import 'admin_screen.dart';
import 'chat_screen.dart';
import 'files_screen.dart';
import 'wahl_screen.dart';
@@ -16,6 +17,13 @@ class HomeScreen extends StatelessWidget {
final kcId = id.kcId;
final tiles = <Widget>[
if (id.isLeitungsteam)
_NavTile(
icon: Icons.admin_panel_settings,
title: 'Verwaltung',
subtitle: 'KCs, Gemeinden, Onboarding-Freigaben',
onTap: () => _open(context, const AdminScreen()),
),
if (id.kind == SessionKind.guest)
_NavTile(
icon: Icons.how_to_vote,
client/app/lib/screens/login_screen.dart
+46 -11
View File
@@ -79,8 +79,10 @@ class _FormShellState extends State<_FormShell> {
return ListView(
shrinkWrap: true,
children: [
Text(widget.title, style: Theme.of(context).textTheme.titleLarge),
const SizedBox(height: 16),
if (widget.title.isNotEmpty) ...[
Text(widget.title, style: Theme.of(context).textTheme.titleLarge),
const SizedBox(height: 16),
],
...widget.fields,
const SizedBox(height: 20),
if (_error != null) ...[
@@ -146,21 +148,54 @@ class _TeamFormState extends State<_TeamForm> {
@override
Widget build(BuildContext context) {
final state = AppScope.of(context);
return _FormShell(
title: 'Teamer:in-Login',
fields: [
_field(_email, 'E-Mail'),
return ListView(
shrinkWrap: true,
children: [
Text('Leitungsteam / Verantwortliche',
style: Theme.of(context).textTheme.titleLarge),
const SizedBox(height: 12),
_field(_password, 'Passwort', obscure: true),
if (state.authError != null) ...[
Text(state.authError!,
style: TextStyle(color: Theme.of(context).colorScheme.error)),
const SizedBox(height: 12),
],
FilledButton.icon(
onPressed: () => state.beginOidcLogin(),
icon: const Icon(Icons.login),
label: const Text('Mit Konfi-Castle-ID anmelden'),
),
const SizedBox(height: 8),
const Text(
'Leitungsteam & Gemeinde-Verantwortliche melden sich über die '
'Konfi-Castle-ID (Authentik) an — dieser Client deckt bisher den '
'lokalen Teamer-Login ab.',
'Öffnet die Konfi-Castle-ID (Authentik). Leitungsteam-Rechte kommen '
'aus deiner Authentik-Gruppe.',
style: TextStyle(fontSize: 12),
),
const Divider(height: 40),
Text('Lokaler Teamer:in-Login',
style: Theme.of(context).textTheme.titleMedium),
const SizedBox(height: 12),
_TeamPasswordForm(email: _email, password: _password),
],
onSubmit: () => state.teamLogin(_email.text.trim(), _password.text),
);
}
}
class _TeamPasswordForm extends StatelessWidget {
const _TeamPasswordForm({required this.email, required this.password});
final TextEditingController email;
final TextEditingController password;
@override
Widget build(BuildContext context) {
final state = AppScope.of(context);
return _FormShell(
title: '',
fields: [
_field(email, 'E-Mail'),
const SizedBox(height: 12),
_field(password, 'Passwort', obscure: true),
],
onSubmit: () => state.teamLogin(email.text.trim(), password.text),
);
}
}