Only allow admin to manage users

internal/backend/backend.go

@@ -109,5 +109,14 @@ func ServeApp(db *sqlx.DB, port int) error {
 }
 
 func authenticationRules(user model.User, method, url string) bool {
+	// For user management, onloy allow if user is admin
+	switch url {
+	case "/api/user",
+		"/api/users",
+		"/api/user/password",
+		"/api/user/password/reset":
+		return user.Admin
+	}
+
 	return true
 }

internal/view/js/dialogs/form-user.js

@@ -30,6 +30,11 @@ export function DialogFormUser() {
 			name: "username",
 			label: i18n("Username"),
 			required: true
+		}, {
+			name: "admin",
+			label: i18n("User is administrator"),
+			type: "boolean",
+			required: true,
 		}]
 
 		formFields.forEach((field, i) => {

internal/view/js/i18n/english.js

@@ -153,4 +153,7 @@ export default new Map([
 	["Old password"],
 	["New password"],
 	["Repeat"],
+
+	// Form user
+	["User is administrator"],
 ])

internal/view/js/i18n/indonesia.js

@@ -153,4 +153,7 @@ export default new Map([
 	["Old password", "Password lama"],
 	["New password", "Password baru"],
 	["Repeat", "Ulangi"],
+
+	// Form user
+	["User is administrator", "User adalah administrator"],
 ])

internal/view/js/pages/root.js

@@ -208,30 +208,30 @@ export function Root() {
 				caption: i18n("Money chart"),
 				href: "#!/chart"
 			})),
-			m(Button, sidebarAttrs("users", {
-				icon: "fa-user-cog",
-				caption: i18n("User management"),
-				href: "#!/users"
-			})),
 			m(".sidebar__spacer"),
 			m(Button, sidebarAttrs(null, {
 				icon: "fa-flag",
 				caption: i18n("Change language"),
 				onclick() { state.dlgLanguage.visible = true }
 			})),
+			m(Button, sidebarAttrs(null, {
+				icon: "fa-key",
+				caption: i18n("Change password"),
+				onclick() { state.dlgPassword.visible = true }
+			})),
 			m(Button, sidebarAttrs(null, {
 				icon: "fa-sign-out-alt",
 				caption: i18n("Logout"),
 				onclick() { state.dlgLogout.visible = true }
 			})),
 		]
 
-		if (state.user != null) {
-			sidebarButtons.splice(5, 0,
-				m(Button, sidebarAttrs(null, {
-					icon: "fa-key",
-					caption: i18n("Change password"),
-					onclick() { state.dlgPassword.visible = true }
+		if (state.user != null && state.user.admin) {
+			sidebarButtons.splice(2, 0,
+				m(Button, sidebarAttrs("users", {
+					icon: "fa-user-cog",
+					caption: i18n("User management"),
+					href: "#!/users"
 				}))
 			)
 		}