proyectos/baby-nas
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add invalid_users directive for Samba shares

Browse Source 
Samba shares now support an 'invalid users' list (deny list), written
as 'invalid users = u1,u2' in smb.conf. The UI shows a ChipPicker
for valid_users and invalid_users, mutually exclusive, sourced from
the system user list.

feat: add ImportSystemUsers for fresh installations

When NASCTL_IMPORT_ON_BOOT=true, nasctl now imports existing system
users from /etc/passwd (UID 1000-60000) and /etc/group (supplemental
groups), and detects which have Samba accounts via 'pdbedit -L'.
Imported users are marked dirty so the admin can review before applying.
New POST /api/import/users endpoint for manual re-import.

This mirrors the existing import-on-boot flow for smb.conf and /etc/exports.
This commit is contained in:
Daniel Arroyo
2026-07-06 15:17:32 -04:00
parent 3e290164c5
commit 03e9368a91
18 changed files with 505 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+1 -1
View File
@@ -1,5 +1,5 @@
BINARY=nasctl
VERSION?=0.5.3
VERSION?=0.6.0
GO?=go
LDFLAGS=-s -w -X github.com/darroyo/nasctl/internal/web.Version=$(VERSION) -X github.com/darroyo/nasctl/internal/web.Commit=$(shell git rev-parse --short HEAD 2>/dev/null || echo unknown)
BUILD_FLAGS=CGO_ENABLED=0
cmd/nasctl/main.go
+5 -1
View File
@@ -59,13 +59,16 @@ func main() {
}
if *importOnBoot {
result := importer.ImportOnBoot(nil, database, *smbConfPath, *exportsPath)
result := importer.ImportOnBoot(nil, database, *smbConfPath, *exportsPath, *adminUser)
if result.SambaImported > 0 {
log.Printf("[importer] imported %d existing samba shares — review and apply", result.SambaImported)
}
if result.NFSImported > 0 {
log.Printf("[importer] imported %d existing nfs exports — review and apply", result.NFSImported)
}
if result.UsersImported > 0 {
log.Printf("[importer] imported %d system users — review and apply", result.UsersImported)
}
}
sambaModule := samba.New(samba.Config{
@@ -87,6 +90,7 @@ func main() {
Auth: auth,
SMBConfPath: *smbConfPath,
ExportsPath: *exportsPath,
AdminUsername: *adminUser,
UploadMaxBytes: *uploadMaxBytes,
PreviewMaxBytes: *previewMaxBytes,
})
internal/db/migrations/0007_samba_invalid_users.sql
+1
View File
@@ -0,0 +1 @@
ALTER TABLE samba_shares ADD COLUMN invalid_users TEXT NOT NULL DEFAULT '[]';
internal/db/models.go
+11 -10
View File
@@ -25,16 +25,17 @@ type Admin struct {
}
type SambaShare struct {
ID int64 `json:"id"`
Name string `json:"name"`
Path string `json:"path"`
Comment string `json:"comment"`
ReadOnly bool `json:"read_only"`
GuestOK bool `json:"guest_ok"`
ValidUsers []string `json:"valid_users"`
ValidGroups []string `json:"valid_groups"`
CreatedAt time.Time `json:"created_at"`
UpdatedAt time.Time `json:"updated_at"`
ID int64 `json:"id"`
Name string `json:"name"`
Path string `json:"path"`
Comment string `json:"comment"`
ReadOnly bool `json:"read_only"`
GuestOK bool `json:"guest_ok"`
ValidUsers []string `json:"valid_users"`
ValidGroups []string `json:"valid_groups"`
InvalidUsers []string `json:"invalid_users"`
CreatedAt time.Time `json:"created_at"`
UpdatedAt time.Time `json:"updated_at"`
}
type NFSClient struct {
internal/db/queries.go
+21 -8
View File
@@ -42,7 +42,7 @@ func scanSambaShare(row interface {
}) (SambaShare, error) {
var share SambaShare
var readOnly, guestOK int
var validUsers, validGroups, createdAt, updatedAt string
var validUsers, validGroups, invalidUsers, createdAt, updatedAt string
if err := row.Scan(
&share.ID,
&share.Name,
@@ -52,6 +52,7 @@ func scanSambaShare(row interface {
&guestOK,
&validUsers,
&validGroups,
&invalidUsers,
&createdAt,
&updatedAt,
); err != nil {
@@ -68,6 +69,10 @@ func scanSambaShare(row interface {
if err != nil {
return SambaShare{}, err
}
share.InvalidUsers, err = decodeJSONStrings(invalidUsers)
if err != nil {
return SambaShare{}, err
}
share.CreatedAt = parseTime(createdAt)
share.UpdatedAt = parseTime(updatedAt)
return share, nil
@@ -170,7 +175,7 @@ func (d *DB) ListApplyLog(limit int) ([]ApplyLogEntry, error) {
func (d *DB) ListSambaShares() ([]SambaShare, error) {
rows, err := d.conn.Query(`
SELECT id, name, path, comment, read_only, guest_ok, valid_users, valid_groups, created_at, updated_at
SELECT id, name, path, comment, read_only, guest_ok, valid_users, valid_groups, invalid_users, created_at, updated_at
FROM samba_shares ORDER BY name ASC`)
if err != nil {
return nil, fmt.Errorf("list samba shares: %w", err)
@@ -190,7 +195,7 @@ func (d *DB) ListSambaShares() ([]SambaShare, error) {
func (d *DB) GetSambaShare(id int64) (SambaShare, error) {
row := d.conn.QueryRow(`
SELECT id, name, path, comment, read_only, guest_ok, valid_users, valid_groups, created_at, updated_at
SELECT id, name, path, comment, read_only, guest_ok, valid_users, valid_groups, invalid_users, created_at, updated_at
FROM samba_shares WHERE id = ?`, id)
share, err := scanSambaShare(row)
if err == sql.ErrNoRows {
@@ -211,6 +216,10 @@ func (d *DB) CreateSambaShare(share SambaShare) (SambaShare, error) {
if err != nil {
return SambaShare{}, err
}
invalidUsers, err := encodeJSONStrings(share.InvalidUsers)
if err != nil {
return SambaShare{}, err
}
readOnly := 0
if share.ReadOnly {
readOnly = 1
@@ -220,9 +229,9 @@ func (d *DB) CreateSambaShare(share SambaShare) (SambaShare, error) {
guestOK = 1
}
result, err := d.conn.Exec(`
INSERT INTO samba_shares (name, path, comment, read_only, guest_ok, valid_users, valid_groups)
VALUES (?, ?, ?, ?, ?, ?, ?)`,
share.Name, share.Path, share.Comment, readOnly, guestOK, validUsers, validGroups,
INSERT INTO samba_shares (name, path, comment, read_only, guest_ok, valid_users, valid_groups, invalid_users)
VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
share.Name, share.Path, share.Comment, readOnly, guestOK, validUsers, validGroups, invalidUsers,
)
if err != nil {
return SambaShare{}, fmt.Errorf("create samba share: %w", err)
@@ -243,6 +252,10 @@ func (d *DB) UpdateSambaShare(id int64, share SambaShare) (SambaShare, error) {
if err != nil {
return SambaShare{}, err
}
invalidUsers, err := encodeJSONStrings(share.InvalidUsers)
if err != nil {
return SambaShare{}, err
}
readOnly := 0
if share.ReadOnly {
readOnly = 1
@@ -253,9 +266,9 @@ func (d *DB) UpdateSambaShare(id int64, share SambaShare) (SambaShare, error) {
}
result, err := d.conn.Exec(`
UPDATE samba_shares
SET name = ?, path = ?, comment = ?, read_only = ?, guest_ok = ?, valid_users = ?, valid_groups = ?, updated_at = datetime('now')
SET name = ?, path = ?, comment = ?, read_only = ?, guest_ok = ?, valid_users = ?, valid_groups = ?, invalid_users = ?, updated_at = datetime('now')
WHERE id = ?`,
share.Name, share.Path, share.Comment, readOnly, guestOK, validUsers, validGroups, id,
share.Name, share.Path, share.Comment, readOnly, guestOK, validUsers, validGroups, invalidUsers, id,
)
if err != nil {
return SambaShare{}, fmt.Errorf("update samba share: %w", err)
internal/db/queries_import.go
+7 -3
View File
@@ -24,6 +24,10 @@ func (d *DB) ReplaceSambaShares(shares []SambaShare) error {
if err != nil {
return err
}
invalidUsers, err := encodeJSONStrings(share.InvalidUsers)
if err != nil {
return err
}
readOnly := 0
if share.ReadOnly {
readOnly = 1
@@ -33,9 +37,9 @@ func (d *DB) ReplaceSambaShares(shares []SambaShare) error {
guestOK = 1
}
_, err = tx.Exec(`
INSERT INTO samba_shares (name, path, comment, read_only, guest_ok, valid_users, valid_groups)
VALUES (?, ?, ?, ?, ?, ?, ?)`,
share.Name, share.Path, share.Comment, readOnly, guestOK, validUsers, validGroups,
INSERT INTO samba_shares (name, path, comment, read_only, guest_ok, valid_users, valid_groups, invalid_users)
VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
share.Name, share.Path, share.Comment, readOnly, guestOK, validUsers, validGroups, invalidUsers,
)
if err != nil {
return fmt.Errorf("insert samba share %s: %w", share.Name, err)
internal/db/queries_users.go
+29
View File
@@ -201,6 +201,35 @@ func (d *DB) ClearDeletedUser(username string) error {
return nil
}
func (d *DB) ReplaceUsers(users []User) error {
tx, err := d.conn.Begin()
if err != nil {
return fmt.Errorf("begin tx: %w", err)
}
defer func() { _ = tx.Rollback() }()
if _, err := tx.Exec(`DELETE FROM system_users`); err != nil {
return fmt.Errorf("clear system_users: %w", err)
}
for _, u := range users {
groups, err := encodeJSONStrings(u.Groups)
if err != nil {
return err
}
_, err = tx.Exec(`
INSERT INTO system_users (username, groups, smb_enabled, disabled, pending_password)
VALUES (?, ?, ?, ?, '')`,
u.Username, groups, boolToInt(u.SMBEnabled), boolToInt(u.Disabled),
)
if err != nil {
return fmt.Errorf("insert user %s: %w", u.Username, err)
}
}
return tx.Commit()
}
func (d *DB) GetAdminByUsername(username string) (Admin, error) {
row := d.conn.QueryRow(
`SELECT id, username, password_hash, created_at, updated_at FROM admins WHERE username = ?`,
internal/importer/import.go
+55 -7
View File
@@ -8,34 +8,42 @@ import (
"github.com/darroyo/nasctl/internal/db"
"github.com/darroyo/nasctl/internal/modules/nfs"
"github.com/darroyo/nasctl/internal/modules/samba"
"github.com/darroyo/nasctl/internal/modules/users"
)
type ImportResult struct {
SambaImported int
NFSImported int
UsersImported int
SambaSkipped bool
NFSSkipped bool
NFSSkipped bool
UsersSkipped bool
SambaError string
NFSError string
UsersError string
}
type ImporterDB interface {
ListSambaShares() ([]db.SambaShare, error)
ListNFSExports() ([]db.NFSExport, error)
ListUsers() ([]db.User, error)
ReplaceSambaShares(shares []db.SambaShare) error
ReplaceNFSExports(exports []db.NFSExport) error
ReplaceUsers(users []db.User) error
GetSetting(key string) (string, bool, error)
SetSetting(key, value string) error
MarkDirty(module string) error
}
func ImportOnBoot(ctx context.Context, database ImporterDB, smbPath, exportsPath string) ImportResult {
func ImportOnBoot(ctx context.Context, database ImporterDB, smbPath, exportsPath, adminUsername string) ImportResult {
result := ImportResult{}
sambaDone, _, _ := database.GetSetting("import.samba.done")
nfsDone, _, _ := database.GetSetting("import.nfs.done")
usersDone, _, _ := database.GetSetting("import.users.done")
if sambaDone == "true" && nfsDone == "true" {
allDone := sambaDone == "true" && nfsDone == "true" && usersDone == "true"
if allDone {
return result
}
@@ -59,8 +67,19 @@ func ImportOnBoot(ctx context.Context, database ImporterDB, smbPath, exportsPath
}
}
if result.SambaImported > 0 || result.NFSImported > 0 {
log.Printf("[importer] imported %d samba shares, %d nfs exports", result.SambaImported, result.NFSImported)
if usersDone != "true" {
ur := importUsers(ctx, database, adminUsername)
result.UsersImported = ur.count
result.UsersSkipped = ur.skipped
result.UsersError = ur.err
if ur.err == "" {
_ = database.SetSetting("import.users.done", "true")
}
}
if result.SambaImported > 0 || result.NFSImported > 0 || result.UsersImported > 0 {
log.Printf("[importer] imported %d samba shares, %d nfs exports, %d users",
result.SambaImported, result.NFSImported, result.UsersImported)
}
return result
@@ -69,13 +88,14 @@ func ImportOnBoot(ctx context.Context, database ImporterDB, smbPath, exportsPath
func ResetImportFlags(ctx context.Context, database ImporterDB) error {
_ = database.SetSetting("import.samba.done", "")
_ = database.SetSetting("import.nfs.done", "")
_ = database.SetSetting("import.users.done", "")
return nil
}
type importStep struct {
count int
count int
skipped bool
err string
err string
}
func importSamba(ctx context.Context, database ImporterDB, path string) importStep {
@@ -133,3 +153,31 @@ func importNFS(ctx context.Context, database ImporterDB, path string) importStep
return importStep{count: len(exports)}
}
func importUsers(ctx context.Context, database ImporterDB, adminUsername string) importStep {
imported, err := ImportSystemUsers(ctx, adminUsername)
if err != nil {
return importStep{err: err.Error()}
}
if imported == nil {
return importStep{skipped: true}
}
existing, err := database.ListUsers()
if err != nil {
return importStep{err: err.Error()}
}
if len(existing) > 0 {
return importStep{skipped: true}
}
if err := database.ReplaceUsers(imported); err != nil {
return importStep{err: err.Error()}
}
if err := database.MarkDirty(users.ModuleName); err != nil {
return importStep{count: len(imported), err: fmt.Sprintf("imported but could not mark dirty: %v", err)}
}
return importStep{count: len(imported)}
}
internal/importer/users.go
+155
View File
@@ -0,0 +1,155 @@
package importer
import (
"bufio"
"context"
"os"
"sort"
"strconv"
"strings"
"github.com/darroyo/nasctl/internal/db"
"github.com/darroyo/nasctl/internal/system"
)
const (
UserMinUID = 1000
UserMaxUID = 60000
)
var excludedUsernames = map[string]bool{
"nobody": true,
"nogroup": true,
"sshd": true,
"systemd": true,
"messagebus": true,
"polkitd": true,
}
func ImportSystemUsers(ctx context.Context, adminUsername string) ([]db.User, error) {
passwdMap, err := readPasswd()
if err != nil {
return nil, err
}
groupMap, err := readGroups()
if err != nil {
return nil, err
}
smbUsers, err := listSMBUsers(ctx)
if err != nil {
smbUsers = map[string]bool{}
}
var users []db.User
for username, uid := range passwdMap {
if uid < UserMinUID || uid > UserMaxUID {
continue
}
if excludedUsernames[username] {
continue
}
if username == adminUsername {
continue
}
users = append(users, db.User{
Username: username,
Groups: groupMap[username],
SMBEnabled: smbUsers[username],
Disabled: false,
})
}
sort.Slice(users, func(i, j int) bool {
return users[i].Username < users[j].Username
})
return users, nil
}
func readPasswd() (map[string]int, error) {
f, err := os.Open("/etc/passwd")
if err != nil {
return nil, err
}
defer f.Close()
result := make(map[string]int)
scanner := bufio.NewScanner(f)
for scanner.Scan() {
line := strings.TrimSpace(scanner.Text())
if line == "" || strings.HasPrefix(line, "#") {
continue
}
parts := strings.Split(line, ":")
if len(parts) < 3 {
continue
}
username := parts[0]
uid, err := strconv.Atoi(parts[2])
if err != nil {
continue
}
result[username] = uid
}
if err := scanner.Err(); err != nil {
return nil, err
}
return result, nil
}
func readGroups() (map[string][]string, error) {
f, err := os.Open("/etc/group")
if err != nil {
return nil, err
}
defer f.Close()
result := make(map[string][]string)
scanner := bufio.NewScanner(f)
for scanner.Scan() {
line := strings.TrimSpace(scanner.Text())
if line == "" || strings.HasPrefix(line, "#") {
continue
}
parts := strings.Split(line, ":")
if len(parts) < 4 {
continue
}
membersStr := strings.TrimSpace(parts[3])
if membersStr == "" {
continue
}
for _, member := range strings.Split(membersStr, ",") {
member = strings.TrimSpace(member)
if member != "" {
result[member] = append(result[member], parts[0])
}
}
}
if err := scanner.Err(); err != nil {
return nil, err
}
return result, nil
}
func listSMBUsers(ctx context.Context) (map[string]bool, error) {
stdout, _, err := system.Run(ctx, "pdbedit", "-L")
if err != nil {
return map[string]bool{}, nil
}
result := make(map[string]bool)
for _, line := range strings.Split(stdout, "\n") {
line = strings.TrimSpace(line)
if line == "" {
continue
}
parts := strings.SplitN(line, ":", 2)
if len(parts) < 1 {
continue
}
result[parts[0]] = true
}
return result, nil
}
internal/modules/samba/samba.go
+9 -7
View File
@@ -37,6 +37,7 @@ type templateShare struct {
GuestOK bool
ValidUsers []string
ValidGroups []string
InvalidUsers []string
}
type templateData struct {
@@ -109,13 +110,14 @@ func (m *Module) renderConfig(shares []db.SambaShare) ([]byte, error) {
data := templateData{Shares: make([]templateShare, 0, len(shares))}
for _, share := range shares {
data.Shares = append(data.Shares, templateShare{
Name: share.Name,
Path: share.Path,
Comment: share.Comment,
ReadOnly: share.ReadOnly,
GuestOK: share.GuestOK,
ValidUsers: share.ValidUsers,
ValidGroups: share.ValidGroups,
Name: share.Name,
Path: share.Path,
Comment: share.Comment,
ReadOnly: share.ReadOnly,
GuestOK: share.GuestOK,
ValidUsers: share.ValidUsers,
ValidGroups: share.ValidGroups,
InvalidUsers: share.InvalidUsers,
})
}
internal/modules/samba/smb.conf.tmpl
+3
View File
@@ -20,5 +20,8 @@
{{- if .ValidGroups}}
valid groups = {{join .ValidGroups ","}}
{{- end}}
{{- if .InvalidUsers}}
invalid users = {{join .InvalidUsers ","}}
{{- end}}
{{end}}
internal/web/auth.go
+3
View File
@@ -196,6 +196,7 @@ type Server struct {
Auth *AuthService
SMBConfPath string
ExportsPath string
AdminUsername string
UploadMaxBytes int64
PreviewMaxBytes int64
}
@@ -205,6 +206,7 @@ type Options struct {
Auth *AuthService
SMBConfPath string
ExportsPath string
AdminUsername string
UploadMaxBytes int64
PreviewMaxBytes int64
}
@@ -223,6 +225,7 @@ func NewServer(database *db.DB, eng *engine.Engine, opts Options) *Server {
Auth: opts.Auth,
SMBConfPath: opts.SMBConfPath,
ExportsPath: opts.ExportsPath,
AdminUsername: opts.AdminUsername,
UploadMaxBytes: opts.UploadMaxBytes,
PreviewMaxBytes: opts.PreviewMaxBytes,
}
internal/web/handlers_import.go
+47 -2
View File
@@ -8,11 +8,13 @@ import (
"github.com/darroyo/nasctl/internal/importer"
"github.com/darroyo/nasctl/internal/modules/nfs"
"github.com/darroyo/nasctl/internal/modules/samba"
"github.com/darroyo/nasctl/internal/modules/users"
)
type importStatus struct {
Samba moduleImportStatus `json:"samba"`
NFS moduleImportStatus `json:"nfs"`
Samba moduleImportStatus `json:"samba"`
NFS moduleImportStatus `json:"nfs"`
Users moduleImportStatus `json:"users"`
}
type moduleImportStatus struct {
@@ -24,9 +26,11 @@ type moduleImportStatus struct {
func (s *Server) handleImportStatus(w http.ResponseWriter, r *http.Request) {
sambaDone, _, _ := s.DB.GetSetting("import.samba.done")
nfsDone, _, _ := s.DB.GetSetting("import.nfs.done")
usersDone, _, _ := s.DB.GetSetting("import.users.done")
shares, _ := s.DB.ListSambaShares()
exports, _ := s.DB.ListNFSExports()
userList, _ := s.DB.ListUsers()
status := importStatus{
Samba: moduleImportStatus{
@@ -37,6 +41,10 @@ func (s *Server) handleImportStatus(w http.ResponseWriter, r *http.Request) {
Done: nfsDone == "true",
Count: len(exports),
},
Users: moduleImportStatus{
Done: usersDone == "true",
Count: len(userList),
},
}
if ts, ok, _ := s.DB.GetSetting("import.samba.at"); ok {
@@ -45,6 +53,9 @@ func (s *Server) handleImportStatus(w http.ResponseWriter, r *http.Request) {
if ts, ok, _ := s.DB.GetSetting("import.nfs.at"); ok {
status.NFS.LastImportAt = ts
}
if ts, ok, _ := s.DB.GetSetting("import.users.at"); ok {
status.Users.LastImportAt = ts
}
writeJSON(w, http.StatusOK, status)
}
@@ -115,9 +126,43 @@ func (s *Server) handleImportNFS(w http.ResponseWriter, r *http.Request) {
writeJSON(w, http.StatusOK, map[string]any{"imported": len(exports)})
}
func (s *Server) handleImportUsers(w http.ResponseWriter, r *http.Request) {
if err := importer.ResetImportFlags(r.Context(), s.DB); err != nil {
writeError(w, http.StatusInternalServerError, err.Error())
return
}
imported, err := importer.ImportSystemUsers(r.Context(), s.AdminUsername)
if err != nil {
writeError(w, http.StatusInternalServerError, err.Error())
return
}
if len(imported) == 0 {
writeJSON(w, http.StatusOK, map[string]any{"imported": 0, "message": "no system users found to import"})
return
}
if err := s.DB.ReplaceUsers(imported); err != nil {
writeError(w, http.StatusInternalServerError, err.Error())
return
}
if err := s.DB.MarkDirty(users.ModuleName); err != nil {
writeError(w, http.StatusInternalServerError, err.Error())
return
}
_ = s.DB.SetSetting("import.users.done", "true")
_ = s.DB.SetSetting("import.users.at", time.Now().Format(time.RFC3339))
writeJSON(w, http.StatusOK, map[string]any{"imported": len(imported)})
}
type dbExporter interface {
ReplaceSambaShares(shares []db.SambaShare) error
ReplaceNFSExports(exports []db.NFSExport) error
ReplaceUsers(users []db.User) error
MarkDirty(module string) error
}
internal/web/handlers_samba.go
+21 -14
View File
@@ -24,13 +24,14 @@ func writeError(w http.ResponseWriter, status int, message string) {
}
type sambaShareRequest struct {
Name string `json:"name"`
Path string `json:"path"`
Comment string `json:"comment"`
ReadOnly bool `json:"read_only"`
GuestOK bool `json:"guest_ok"`
ValidUsers []string `json:"valid_users"`
ValidGroups []string `json:"valid_groups"`
Name string `json:"name"`
Path string `json:"path"`
Comment string `json:"comment"`
ReadOnly bool `json:"read_only"`
GuestOK bool `json:"guest_ok"`
ValidUsers []string `json:"valid_users"`
ValidGroups []string `json:"valid_groups"`
InvalidUsers []string `json:"invalid_users"`
}
func (req sambaShareRequest) validate(allowedRoots []string) error {
@@ -45,18 +46,24 @@ func (req sambaShareRequest) validate(allowedRoots []string) error {
return err
}
}
for _, user := range req.InvalidUsers {
if err := system.ValidateUsername(user); err != nil {
return err
}
}
return nil
}
func (req sambaShareRequest) toModel() db.SambaShare {
return db.SambaShare{
Name: req.Name,
Path: req.Path,
Comment: req.Comment,
ReadOnly: req.ReadOnly,
GuestOK: req.GuestOK,
ValidUsers: req.ValidUsers,
ValidGroups: req.ValidGroups,
Name: req.Name,
Path: req.Path,
Comment: req.Comment,
ReadOnly: req.ReadOnly,
GuestOK: req.GuestOK,
ValidUsers: req.ValidUsers,
ValidGroups: req.ValidGroups,
InvalidUsers: req.InvalidUsers,
}
}
internal/web/router.go
+1
View File
@@ -39,6 +39,7 @@ func NewRouter(s *Server) chi.Router {
protected.Get("/import/status", s.handleImportStatus)
protected.Post("/import/samba", s.handleImportSamba)
protected.Post("/import/nfs", s.handleImportNFS)
protected.Post("/import/users", s.handleImportUsers)
protected.Route("/samba/shares", func(shares chi.Router) {
shares.Get("/", s.handleListSambaShares)
web/src/api.ts
+4
View File
@@ -7,6 +7,7 @@ export interface SambaShare {
guest_ok: boolean;
valid_users: string[];
valid_groups: string[];
invalid_users: string[];
}
export interface NFSClient {
@@ -213,6 +214,9 @@ export const api = {
createWatchedMount: (path: string) => request<WatchedMount>("POST", "/system/watched-mounts", { path }),
deleteWatchedMount: (id: number) => request<void>("DELETE", `/system/watched-mounts/${id}`),
// import
importUsers: () => request<{ imported: number; message?: string }>("POST", "/import/users"),
// files
fileCapabilities: () => request<FileCapabilities>("GET", "/files/capabilities"),
fileRoots: () => request<{ roots: string[]; unrestricted: boolean }>("GET", "/files/roots"),
web/src/pages/Samba.tsx
+115 -21
View File
@@ -1,5 +1,5 @@
import { FormEvent, useEffect, useState } from "react";
import { api, SambaShare } from "../api";
import { api, SambaShare, User } from "../api";
import { useDirty } from "../DirtyContext";
import Modal from "../components/Modal";
import PathField from "../components/PathField";
@@ -12,12 +12,73 @@ const empty: Partial<SambaShare> = {
guest_ok: false,
valid_users: [],
valid_groups: [],
invalid_users: [],
};
type ChipPickerProps = {
label: string;
options: User[];
selected: string[];
onChange: (selected: string[]) => void;
allowRemove?: boolean;
};
function ChipPicker({ label, options, selected, onChange }: ChipPickerProps) {
const available = options.filter((u) => !selected.includes(u.username));
return (
<div className="space-y-2">
<label className="label">{label}</label>
{selected.length > 0 && (
<div className="flex flex-wrap gap-1.5">
{selected.map((username) => {
const user = options.find((u) => u.username === username);
const isSMB = user?.smb_enabled;
return (
<span
key={username}
className="inline-flex items-center gap-1 rounded-full bg-emerald-500/20 px-2.5 py-0.5 text-xs text-emerald-300"
>
{username}
{isSMB && <span title="SMB habilitado">*</span>}
<button
type="button"
className="ml-0.5 rounded-full hover:text-white"
onClick={() => onChange(selected.filter((u) => u !== username))}
>
×
</button>
</span>
);
})}
</div>
)}
{available.length > 0 && (
<div className="flex flex-wrap gap-1.5">
{available.map((user) => (
<button
key={user.username}
type="button"
className="rounded-full bg-slate-700 px-2.5 py-0.5 text-xs text-slate-300 hover:bg-slate-600 hover:text-white"
onClick={() => onChange([...selected, user.username])}
>
+ {user.username}
</button>
))}
</div>
)}
{options.length === 0 && (
<p className="text-xs text-slate-500">No hay usuarios del sistema. Créalos primero.</p>
)}
</div>
);
}
export default function Samba() {
const [shares, setShares] = useState<SambaShare[]>([]);
const [editing, setEditing] = useState<Partial<SambaShare> | null>(null);
const [error, setError] = useState<string | null>(null);
const [systemUsers, setSystemUsers] = useState<User[]>([]);
const { refresh } = useDirty();
async function load() {
@@ -25,10 +86,24 @@ export default function Samba() {
setShares(res.shares ?? []);
}
async function loadSystemUsers() {
try {
const res = await api.listUsers();
setSystemUsers(res.users ?? []);
} catch {
setSystemUsers([]);
}
}
useEffect(() => {
load();
}, []);
function openEditor(share: Partial<SambaShare> | null) {
setEditing(share ? { ...share } : { ...empty });
loadSystemUsers();
}
async function save(e: FormEvent) {
e.preventDefault();
if (!editing) return;
@@ -58,7 +133,7 @@ export default function Samba() {
<div className="space-y-6">
<div className="flex items-center justify-between">
<h1 className="text-2xl font-bold text-white">Shares SMB / Samba</h1>
<button className="btn-primary" onClick={() => setEditing({ ...empty })}>
<button className="btn-primary" onClick={() => openEditor(null)}>
Nuevo share
</button>
</div>
@@ -82,9 +157,25 @@ export default function Samba() {
<td className="px-4 py-3 text-slate-300">{s.path}</td>
<td className="px-4 py-3">{s.read_only ? "Solo lectura" : "Lectura/Escritura"}</td>
<td className="px-4 py-3">{s.guest_ok ? "Sí" : "No"}</td>
<td className="px-4 py-3 text-slate-400">{s.valid_users.join(", ") || "—"}</td>
<td className="px-4 py-3">
<div className="flex flex-wrap gap-1">
{s.valid_users.map((u) => (
<span key={u} className="rounded-full bg-emerald-500/20 px-2 py-0.5 text-xs text-emerald-300">
{u}
</span>
))}
{s.invalid_users.map((u) => (
<span key={u} className="rounded-full bg-red-500/20 px-2 py-0.5 text-xs text-red-300">
!{u}
</span>
))}
{s.valid_users.length === 0 && s.invalid_users.length === 0 && (
<span className="text-slate-500">—</span>
)}
</div>
</td>
<td className="px-4 py-3 text-right">
<button className="btn-ghost mr-2" onClick={() => setEditing({ ...s })}>
<button className="btn-ghost mr-2" onClick={() => openEditor(s)}>
Editar
</button>
<button className="btn-danger" onClick={() => remove(s.id)}>
@@ -122,7 +213,7 @@ export default function Samba() {
<label className="label">Path (absoluto)</label>
<PathField
value={editing.path ?? ""}
onChange={p => setEditing({ ...editing, path: p })}
onChange={(p) => setEditing({ ...editing, path: p })}
/>
</div>
<div>
@@ -133,22 +224,25 @@ export default function Samba() {
onChange={(e) => setEditing({ ...editing, comment: e.target.value })}
/>
</div>
<div>
<label className="label">Usuarios válidos (separados por coma)</label>
<input
className="input"
value={(editing.valid_users ?? []).join(", ")}
onChange={(e) =>
setEditing({
...editing,
valid_users: e.target.value
.split(",")
.map((v) => v.trim())
.filter(Boolean),
})
}
/>
</div>
<ChipPicker
label="Usuarios válidos (acceso permitido)"
options={systemUsers}
selected={editing.valid_users ?? []}
onChange={(selected) =>
setEditing({ ...editing, valid_users: selected })
}
/>
<ChipPicker
label="Usuarios denegados (acceso explícitamente bloqueado)"
options={systemUsers}
selected={editing.invalid_users ?? []}
onChange={(selected) =>
setEditing({ ...editing, invalid_users: selected })
}
/>
<div className="flex gap-6">
<label className="flex items-center gap-2 text-sm text-slate-300">
<input
web/src/pages/Users.tsx
+17 -3
View File
@@ -57,9 +57,23 @@ export default function Users() {
<div className="space-y-6">
<div className="flex items-center justify-between">
<h1 className="text-2xl font-bold text-white">Usuarios del sistema</h1>
<button className="btn-primary" onClick={() => setEditing({ ...empty })}>
Nuevo usuario
</button>
<div className="flex gap-2">
<button className="btn-ghost" onClick={async () => {
try {
const res = await api.importUsers();
await load();
await refresh();
alert(`Importados ${res.imported} usuarios del sistema. Revisa y aplica los cambios.`);
} catch (err) {
alert(err instanceof Error ? err.message : "Error al importar");
}
}}>
Re-importar del sistema
</button>
<button className="btn-primary" onClick={() => setEditing({ ...empty })}>
Nuevo usuario
</button>
</div>
</div>
<div className="card overflow-x-auto p-0">