mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-18 21:16:47 +00:00
Maurice
4b3fb7dec9
Role mapping read the configured OIDC_ADMIN_CLAIM out of the userinfo payload and collapsed two very different answers into one: the claim arrived and did not name an admin, and the claim was not there at all. The second is not a verdict about the user — it is what an operator sees when the scope carrying that claim was never requested, or the claim name has a typo. TREK wrote role='user' for it anyway, with nothing in the log, nothing in the audit trail and nothing in the UI, so a misconfiguration read as an unexplained loss of admin. The only guard was the last-admin rule, which protects an instance with exactly one admin row and therefore almost nobody. An absent claim now leaves the stored role untouched. A claim that does arrive still promotes and demotes exactly as before. To keep the silence from moving somewhere worse, an absent claim on an account that is already an admin warns on every login, naming the account: providers that omit a claim rather than send it empty — Okta's filtered groups, Entra ID — cannot take admin away through the mapping at all, and that has to be done in TREK's own admin panel. The ordinary case still warns once per claim name, listing the claim names that did arrive (never their values) and pointing at OIDC_SCOPE. A real transition writes an audit row from the controller, with the client IP. Closes #2364