be1c4fe5f9
Initial commit for gscMy carved out as its own repo (was tracked
loosely under the monorepo's web/ which is gitignored).
What this contains:
- Auth: next-auth v5 via @gsc/web-kit createAuth (Keycloak only,
identity sourced from claims, no admin.users writes)
- Chrome: @gsc/web-kit AdminShell — replaces the legacy MyShell.
Sidebar JSON config carried over and mapped to DbMenuItem.
- Middleware: createAuthMiddleware. Public: /access-denied,
/auth/keycloak, /signed-out, /api/health, /api/pam/approve.
- RP-initiated signout at /api/auth/signout → Keycloak end_session →
/signed-out (mirrors gscAdmin).
- Phosphor-iconned access-denied + signed-out landing pages.
PAM/JIT request flow (ported from gscAdmin's pre-strip git history):
- /access page (Active + Eligible tables, request modal with
duration slider + justification + optional MFA)
- API: /api/pam/{eligible, active, audit, request, approve/:token,
revoke/:id}
- src/lib/{authz, pam, pam-mail, pam-mfa}.ts — same files as
gscAdmin had before the strip. PAM tables (admin.privilege_*)
are shared with gscAdmin; gscMy uses the same Prisma model defs.
- Top-bar widget shows active grants with countdown + revoke.
Build/Deploy: Dockerfile (monorepo-root context), k8s manifests for
my.gosec.internal, self-signed TLS placeholder, DNS A record.
Keycloak gsc-my client extended to include my.gosec.internal/* in
redirect_uris + web_origins.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
80 lines
1.5 KiB
JSON
80 lines
1.5 KiB
JSON
[
|
|
{
|
|
"id": 100001,
|
|
"icon": "ph-house",
|
|
"name": "Dashboard",
|
|
"url": "/",
|
|
"key": "Dashboard",
|
|
"submenulvl1": []
|
|
},
|
|
{
|
|
"id": 100002,
|
|
"icon": "ph-user-circle",
|
|
"name": "Account",
|
|
"url": "#",
|
|
"key": "Account",
|
|
"submenulvl1": [
|
|
{
|
|
"name": "Profile",
|
|
"url": "/profile",
|
|
"key": "account_profile",
|
|
"icon": "ph-identification-card"
|
|
},
|
|
{
|
|
"name": "Settings",
|
|
"url": "/settings",
|
|
"key": "account_settings",
|
|
"icon": "ph-gear"
|
|
},
|
|
{
|
|
"name": "Security",
|
|
"url": "/security",
|
|
"key": "account_security",
|
|
"icon": "ph-shield-check"
|
|
},
|
|
{
|
|
"name": "Privacy",
|
|
"url": "/privacy",
|
|
"key": "account_privacy",
|
|
"icon": "ph-lock-key"
|
|
},
|
|
{
|
|
"name": "Analytics",
|
|
"url": "/analytics",
|
|
"key": "account_analytics",
|
|
"icon": "ph-chart-line-up"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 100003,
|
|
"icon": "ph-chat-circle-dots",
|
|
"name": "Communication",
|
|
"url": "#",
|
|
"key": "Communication",
|
|
"submenulvl1": [
|
|
{
|
|
"name": "Voice",
|
|
"url": "/voice",
|
|
"key": "comm_voice",
|
|
"icon": "ph-phone"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": 100004,
|
|
"icon": "ph-brain",
|
|
"name": "AI",
|
|
"url": "#",
|
|
"key": "AI",
|
|
"submenulvl1": [
|
|
{
|
|
"name": "Agent",
|
|
"url": "/agent",
|
|
"key": "ai_agent",
|
|
"icon": "ph-robot"
|
|
}
|
|
]
|
|
}
|
|
]
|