49ab89ae46
Claiming the system administrator role no longer grants access to every application in the installation. Owning a tenant is what lets an administrator administer it; entering the applications running inside it is a separate, explicit grant that can be withdrawn again. Handing it out at claim time gave every installation a standing administrator account inside every customer application, which is the opposite of the boundary this product draws. The behaviour suite now covers single sign-on between applications directly: a second application on the same tenant must receive a code and identify the same person with no sign-in page in between, once Go Loose already holds a session. Also adds theme-token tests against the shared styling contract and store coverage for application grants, and drops the redundant server and security scheme declarations from the published specification. |
||
|---|---|---|
| .. | ||
| account_test.go | ||
| clientauth.go | ||
| installer.go | ||
| installer_test.go | ||
| oidc.go | ||
| oidc_test.go | ||
| origin_test.go | ||
| passwordauth.go | ||
| passwordauth_test.go | ||
| permissions.go | ||
| profile.go | ||
| profile_test.go | ||
| roles.go | ||
| roles_test.go | ||
| server.go | ||
| tenantauth.go | ||
| tenantauth_test.go | ||
| theme_test.go | ||
| useradmin.go | ||