From db2b6e62b83a040ffe185e6208799e5b8c57e64c Mon Sep 17 00:00:00 2001 From: Marco Mooij | DigiState Date: Fri, 15 May 2026 13:43:56 +0200 Subject: [PATCH] Access control documented --- .../servers/POST Create or update server.md | 1 - Installation.md | 23 +++++++------- Portal Management/Access Control/Admins.md | 30 +++++++++++++++++++ .../Access Control/Permissions.md | 18 ++++++++++- .../Access Control/User groups.md | 21 ++++++++++++- Portal Management/Settings/Global.md | 10 +++---- Portal Management/Settings/Mail.md | 6 ++-- Portal Management/Settings/Modules.md | 2 +- Release notes.md | 6 ++++ Untitled.md | 0 index.md | 2 +- 11 files changed, 95 insertions(+), 24 deletions(-) create mode 100644 Untitled.md diff --git a/API/v1/servers/POST Create or update server.md b/API/v1/servers/POST Create or update server.md index a8588cd..6d8f8db 100644 --- a/API/v1/servers/POST Create or update server.md +++ b/API/v1/servers/POST Create or update server.md @@ -1,6 +1,5 @@ # POST Create or update server This API call creates a server or updates it with the given information. - #### Location ``` /api/v1/servers/ diff --git a/Installation.md b/Installation.md index eecd6a7..0a593b7 100644 --- a/Installation.md +++ b/Installation.md @@ -1,19 +1,20 @@ # Installation This guide explains how to install Sentri on a Linux server. -# Requirements +## Requirements Before continuing, make sure your server meets the following requirements: + - A Linux server (Linux is officially tested and supported) - Basic Linux and web hosting experience -- A web server of your choice (Apache, Nginx, Caddy, etc.) +- A web server of your choice (Apache, Nginx, etc.) - MariaDB or MySQL - PHP 8.3 or newer - Git installed on the server >[!info] >This guide uses `/var/www/sentri/` as the installation directory. You can change this to any location you prefer. -# Installation +## Installation -## Configure the document root +### Configure the document root Sentri stores all publicly accessible files inside the `pub/` directory. If your current virtual host document root is: ``` @@ -24,7 +25,7 @@ Change it to: /var/www/sentri/pub/ ``` After updating the document root, reload or restart your web server. -## Download the Sentri files +### Download the Sentri files Run the following commands to download the latest version of Sentri: ```bash cd /var/www/sentri/ @@ -36,7 +37,7 @@ mv Sentri/.[!.]* . 2>/dev/null rmdir Sentri ``` -## Database setup +### Database setup Log in to MariaDB/MySQL and create the database and user: ```sql CREATE DATABASE sentri; @@ -50,7 +51,7 @@ Next, import the database schema: mariadb -u sentri -p sentri < /var/www/sentri/install.sql ``` When prompted, enter the password for the `sentri` database user. -## Configuring +### Configuring Copy the example configuration file: ```bash cp /var/www/sentri/pub/config-sample.php /var/www/sentri/pub/config.php @@ -59,7 +60,7 @@ Then edit the configuration file and update the database credentials: ``` /var/www/sentri/pub/config.php ``` -### First Login +#### First Login Open your website in a browser and log in with the default credentials: ``` Username: superuser @@ -68,13 +69,13 @@ Password: changethispassword > [!WARNING] > After logging in change the superuser password! -### Global settings +#### Global settings Go to [[Global|Global]] under Portal Management and rename the portal to your preference. Next, configure the SMTP connection in [[Mail|Mail]] under Portal Management so Sentri can send emails. Finally, enable the [[index#Modules|modules]] you want to use in [[Portal Management/Settings/Modules|Modules]] under Portal Management. -### Create users and check permissions +#### Create users and check permissions Go to the -### Getting started +#### Getting started After completing the installation, continue with the [[Getting Started]] guide to configure and begin using Sentri. diff --git a/Portal Management/Access Control/Admins.md b/Portal Management/Access Control/Admins.md index e0cd442..3bfc36a 100644 --- a/Portal Management/Access Control/Admins.md +++ b/Portal Management/Access Control/Admins.md @@ -1 +1,31 @@ # Admins +Admins are users who are not tied to specific companies and are responsible for administering Sentri. +## View admin +To view admins, you need the `admin-access-admins` RO permission. + +In the admins list, click the **view** icon to open an admin and see additional details. +## Add admin +To create a new admin, you need the `admin-access-admins` RW permission. + +Complete the form and click **Add admin**. The admin will be created in a **Pending** state. + +After creation, an invitation email is sent. The recipient must verify their account and set a password. Once completed, the admin becomes **Active**. +## Modify admin +To manage admins, you need the `admin-access-admins` RW permission. + +You can edit an admin by clicking the **edit** icon in the admin list or by selecting **Edit** while viewing the admin details. +### Send password reset email +To send a password reset email, you need the `admin-access-admins-resetpassword` RW permission. + +Open the admin details and click **Send password reset email** in the user management section. +### Disable two factor authentication +To disable two-factor authentication for another admin, you need the `admin-access-admins-mfa` RW permission. + +Open the admin details and click **Disable two-factor authentication** in the user management section. +# Admin status +An admin can have one of the following statuses: + +- **Active** – The admin is active and can log in. +- **Pending** – The admin has been created but has not yet verified their account or set a password via the invitation email. +- **Banned** – The admin is blocked due to suspicious or policy-violating behavior and cannot log in. +- **Inactive** – The admin account is disabled and cannot log in. \ No newline at end of file diff --git a/Portal Management/Access Control/Permissions.md b/Portal Management/Access Control/Permissions.md index d230eed..09e11ab 100644 --- a/Portal Management/Access Control/Permissions.md +++ b/Portal Management/Access Control/Permissions.md @@ -1 +1,17 @@ -# Permissions \ No newline at end of file +# Permissions +Many actions in Sentri require specific permissions. These permissions are configured per user group and can be set to one of the following levels: + +- NA (Not Available) +- RO (Read Only) +- RW (Read Write) + +> [!INFO] +> The **superuser** account has RW access to all permissions by default. This behavior is intentional and cannot be changed. +## Viewing or modifying permissions +To view permissions, you need the `admin-access-control-permissions` RO permission. + +To modify permissions, you need the `admin-access-control-permissions` RW permission. + +Navigate to **Access control** > **Permissions** and click the **view** icon. You will see the permission set assigned to each user group. + +If you want to view or modify all permissions for a specific user group, go to **Access control** > **User groups**, then click the **view icon** next to the user group you want to view or modify. This will display the full list of permissions configured on that group. \ No newline at end of file diff --git a/Portal Management/Access Control/User groups.md b/Portal Management/Access Control/User groups.md index f56e3b7..eeeadaf 100644 --- a/Portal Management/Access Control/User groups.md +++ b/Portal Management/Access Control/User groups.md @@ -1 +1,20 @@ -# User groups \ No newline at end of file +# User groups +All users in Sentri are assigned to a user group. There are currently two types of user groups: + +- **Administrator** – Users not tied to specific companies. They are responsible for administering Sentri and are created [[Admins|here]]. +- **User** – Intended for future use for users linked to specific companies. This group type is not yet active in Sentri. + +## User group weight +Each user group has an associated **weight**, which is used to enforce hierarchy and prevent privilege escalation. + +For example, if your current user group has a weight of **10**, you cannot create or assign a user to a group with a lower weight (e.g. **1**) if that would result in higher permissions than your own. This ensures users cannot create accounts with greater access than their own. +## Adding a user group +To add a user group, you need the `admin-access-control-user-groups` RW permission. + +Navigate to **Access Control** > **User groups** and click **Add user group**. Enter a name and select the group type. + +After creation, you will be able to configure the group’s [[Permissions|permissions]]. To modify permissions, you also need the `admin-access-control-permissions` **RW** permission. +## Viewing user groups +To view user groups, you need the `admin-access-control-user-groups` RO permission. + +Go to **Access Control** > **User groups** and click the **view icon** next to a user group. This will show detailed information about the group, including all configured [[Permissions|permissions]]. \ No newline at end of file diff --git a/Portal Management/Settings/Global.md b/Portal Management/Settings/Global.md index d54ed42..baf3e94 100644 --- a/Portal Management/Settings/Global.md +++ b/Portal Management/Settings/Global.md @@ -1,14 +1,14 @@ # Global -# Portal name +## Portal name This setting allows you to change the name of the portal. Currently, this setting has limited functionality, but it will be used in future versions to support white-labeling. -# Portal provider name +## Portal provider name This setting allows you to change the provider name displayed by the portal. Currently, this setting has limited functionality, but it will also be used in future versions to support white-labeling. -# Admin authentication methods +## Admin authentication methods This setting will later support multiple administrator authentication methods. Currently, the only available option is `database_auth`. -# CA certificate URL +## CA certificate URL This URL points to the Certificate Authority (CA) certificate used by the auto-provisioning module, which is currently under development. -# Autoprovisioning URL +## Autoprovisioning URL This URL is used by the auto-provisioning system to retrieve configuration data by the auto-provisioning module, which is currently under development.. \ No newline at end of file diff --git a/Portal Management/Settings/Mail.md b/Portal Management/Settings/Mail.md index 41e5984..6104d23 100644 --- a/Portal Management/Settings/Mail.md +++ b/Portal Management/Settings/Mail.md @@ -6,11 +6,11 @@ Sentri sends emails in the following situations: - When a new user is created, an invitation email is sent to the user. - When a user requests a password reset. - When an administrator sends a password reset email. -# From Name +## From Name This is the sender name displayed in emails sent by Sentri. -# From Address +## From Address This is the email address used by Sentri to send emails. -# SMTP Server Configuration +## SMTP Server Configuration ### Host The hostname or IP address of your SMTP server. ### Secure diff --git a/Portal Management/Settings/Modules.md b/Portal Management/Settings/Modules.md index 9651f42..1dc4ea5 100644 --- a/Portal Management/Settings/Modules.md +++ b/Portal Management/Settings/Modules.md @@ -1,6 +1,6 @@ # Modules Sentri allows modules to be enabled or disabled. Each module provides its own functionality, which can be viewed [[../../index|here]]. -# Enabling and Disabling Modules +## Enabling and Disabling Modules To enable or disable modules, navigate to **Settings** > **Modules** and toggle the modules you want to enable or disable. > [!Note] diff --git a/Release notes.md b/Release notes.md index 6ba1fc9..eba6a13 100644 --- a/Release notes.md +++ b/Release notes.md @@ -4,6 +4,7 @@ To be announced ### Changes - Changed portal management page to Settings and changed System in the sidebar to Portal management. - Removed vc_ prefix from certain database tables. +- Display user group weight in user groups view. ## v.1.2 `06-05-2026` @@ -19,6 +20,11 @@ To be announced - Filtering and ordering on backup types fixed in server overview. ### Known issues - Sidebar text is showing when sidebar is wrapped. +- Avatar upload button is dark +- non-superuser admins can update the permission name and description, this should be limited to the superuser. +- Problem with enabling and disabling modules as superuser. +- Administrator can change superuser permissions. +- problem with redirect after creating a user-group. When creating a group it does not create the permissions for the new user group. also a 500 error is displayed. ## v.1.1 `07-01-2026` ### Changes diff --git a/Untitled.md b/Untitled.md new file mode 100644 index 0000000..e69de29 diff --git a/index.md b/index.md index 254d8f3..48fb372 100644 --- a/index.md +++ b/index.md @@ -2,7 +2,7 @@ >[!note] >The making of the this documentation is still in progress. # What is Sentri -Sentri is a self-hosted web application built around a modular system. Each module provides a specific feature or solves a particular use case, and was created from practical needs encountered throughout my career as a system and network administrator. Instead of relying on multiple separate services or portals for smaller operational tasks, Sentri centralizes them into a single platform. +Sentri is a self-hosted web application built as a modular system. Each module provides a specific feature or solves a particular use case, and was created from practical needs encountered throughout my career as a system and network administrator. Instead of relying on multiple separate services or portals for smaller operational tasks, Sentri centralizes them into a single platform. Its modular structure keeps the platform lightweight and flexible by allowing you to enable only the components you actually use. Sentri is open-source, performance-focused, and designed to remain minimal and simple. Because Sentri is fully self-hosted, all data remains under your control without depending on third-party providers.