User Management - Issue #717 (#781)

* ISSUE #717

* CR Fixes

* auth users route only for admin

* fix build

* Return 401

client/src/javascript/components/AppWrapper.js

@@ -42,6 +42,7 @@ class AuthEnforcer extends React.Component {
       authStatusDetermined: false,
       dependencies: {},
       isAuthenticated: false,
+      isInitialUser: false,
       isClientConnected: ClientStatusStore.getIsConnected(),
       dependenciesLoaded: false,
     };
@@ -82,10 +83,10 @@ class AuthEnforcer extends React.Component {
 
   handleVerifySuccess(data) {
     if (data.initialUser) {
-      this.setState({authStatusDetermined: true, isAuthenticated: false});
+      this.setState({authStatusDetermined: true, isAuthenticated: false, isInitialUser: true});
       browserHistory.replace('register');
     } else {
-      this.setState({authStatusDetermined: true, isAuthenticated: true});
+      this.setState({authStatusDetermined: true, isAuthenticated: true, isInitialUser: false});
       ClientActions.fetchSettings();
       SettingsActions.fetchSettings();
       browserHistory.replace('overview');
@@ -93,12 +94,12 @@ class AuthEnforcer extends React.Component {
   }
 
   handleVerifyError() {
-    this.setState({authStatusDetermined: true, isAuthenticated: false});
+    this.setState({authStatusDetermined: true, isAuthenticated: false, isInitialUser: false});
     browserHistory.replace('login');
   }
 
   handleLoginError() {
-    this.setState({authStatusDetermined: true, isAuthenticated: false});
+    this.setState({authStatusDetermined: true, isAuthenticated: false, isInitialUser: false});
     browserHistory.replace('login');
   }
 
@@ -106,13 +107,13 @@ class AuthEnforcer extends React.Component {
     ClientActions.fetchSettings();
     SettingsActions.fetchSettings();
     FloodActions.restartActivityStream();
-    this.setState({authStatusDetermined: true, isAuthenticated: true});
+    this.setState({authStatusDetermined: true, isAuthenticated: true, isInitialUser: false});
     browserHistory.replace('overview');
   }
 
   handleRegisterSuccess() {
     FloodActions.restartActivityStream();
-    this.setState({authStatusDetermined: true, isAuthenticated: true});
+    this.setState({authStatusDetermined: true, isAuthenticated: true, isInitialUser: false});
     browserHistory.replace('overview');
   }
 
@@ -163,10 +164,11 @@ class AuthEnforcer extends React.Component {
     }
 
     if (this.state.isAuthenticated && !this.state.isClientConnected) {
+      const {isInitialUser} = this.state;
       return (
         <div className="application__loading-overlay">
           <div className="application__entry-barrier">
-            <ClientConnectionInterruption />
+            <ClientConnectionInterruption isInitialUser={isInitialUser} />
           </div>
         </div>
       );

client/src/javascript/components/general/ClientConnectionInterruption.js

@@ -101,8 +101,30 @@ export default class ClientConnectionInterruption extends React.Component {
   }
 
   render() {
+    const isAdmin = AuthStore.isAdmin();
+    const {isInitialUser} = this.props;
     const {isConnectionVerified, isTestingConnection} = this.state;
 
+    if (!isAdmin && !isInitialUser) {
+      return (
+        <Panel spacing="large">
+          <PanelHeader>
+            <h1>
+              <FormattedMessage id="connection-interruption.heading" defaultMessage="Cannot connect to rTorrent" />
+            </h1>
+          </PanelHeader>
+          <PanelContent>
+            <p className="copy--lead">
+              <FormattedMessage
+                id="connection-interruption.verify-settings-not-admin"
+                defaultMessage="Please contact your Flood administator to fix the issue."
+              />
+            </p>
+          </PanelContent>
+        </Panel>
+      );
+    }
+
     return (
       <Panel spacing="large">
         <Form

server/routes/auth.js

@@ -139,6 +139,15 @@ router.get('/logout', (req, res) => {
   res.clearCookie('jwt').send();
 });
 
+router.use('/users', (req, res, next) => {
+  if (req.user && req.user.isAdmin) {
+    next();
+    return;
+  }
+
+  res.status(401).send('Not authorized');
+});
+
 router.get('/users', (req, res) => {
   Users.listUsers(ajaxUtil.getResponseFn(res));
 });