無料GitHub で公開

admin-auth-guide

Admin authentication and authorization system reference — login flow, JWT, TOTP, sessions, RBAC

aibot88/sec_skill_store

インストール方法を見る

含まれるファイル（2）

SKILL.md3.1 KB
source.json614 B

SKILL.md（原文）

インストールする前に、エージェントに与えられる指示の中身を確認できます。

Admin Auth & Authorization Guide

Authentication Flow

Step 1: Telegram Login

User clicks "Login with Telegram" widget
Frontend sends Telegram init_data to Login Backend (:8082)
Login Backend validates hash signature against bot token
Extracts tg_id from init_data

Step 2: First-Time Setup

If admin user has no TOTP configured:

Generate TOTP secret (encrypted with AES-GCM, key from LOGIN_TOTP_SECRET_KEY)
Return QR code + recovery codes to frontend
User scans QR in authenticator app
User confirms with TOTP code
User sets initial password (bcrypt hashed)

Step 3: Returning Login

Verify TOTP code (6-digit)
Verify password (bcrypt)
Issue JWT token

Step 4: JWT Token

Claims:

{
  "sub": "admin_user_uuid",
  "sid": "session_uuid",
  "role": "admin|superadmin|...",
  "exp": "...",
  "iat": "..."
}

Signed with LOGIN_JWT_SECRET (must match ADMIN_WEB_JWT_SECRET in backend)
Frontend stores in memory/localStorage

Step 5: Session Management

Server-side session in admin_sessions table
Session has idle timeout (ADMIN_WEB_SESSION_IDLE_TIMEOUT, default 30m)
Session has max lifetime (LOGIN_SESSION_MAX_LIFETIME, default 12h)
Each API request refreshes idle timeout
Session deleted on logout

Backend Auth Middleware

AdminWebAuthMiddleware

Location: backend/internal/transport/http/middleware/

Extract Authorization: Bearer <token> header
Validate JWT signature and expiration
Extract sid claim
Check session exists in admin_sessions table
Check session not expired (idle + max lifetime)
Refresh idle timeout
Set identity in request context

RequireAdminRoleOrPermission

Location: backend/internal/app/apiapp/routes.go

Two modes (ADMIN_AUTHZ_MODE):

dual: check legacy role allowlist OR permission-based access
permission_only: only check permissions (target mode)

Permissions are granular: view_metrics, export_data, manage_users, moderate_content, manage_access, manage_settings, etc.

Key Files

File	Purpose
`adminpanel/backend/login/`	Login backend service
`backend/internal/services/adminacl/`	Admin ACL service
`backend/internal/repo/postgres/admin_session_repo.go`	Session repository
`backend/internal/transport/http/middleware/`	Auth middleware
`adminpanel/frontend/src/admin/`	Frontend auth layer
`adminpanel/frontend/src/lib/adminAuthApi.ts`	Auth API client
`adminpanel/frontend/src/pages/LoginPage.tsx`	Login UI

Environment Variables

# Login Backend
LOGIN_JWT_SECRET=<shared-with-backend>
LOGIN_TOTP_SECRET_KEY=<base64-32-byte-AES-key>
LOGIN_TELEGRAM_BOT_TOKEN=<telegram-bot-token>
LOGIN_SESSION_IDLE_TIMEOUT=30m
LOGIN_SESSION_MAX_LIFETIME=12h
LOGIN_DEV_MODE=true  # enables debug init_data login

# Backend
ADMIN_WEB_JWT_SECRET=<must-match-LOGIN_JWT_SECRET>
ADMIN_WEB_SESSION_IDLE_TIMEOUT=30m
ADMIN_AUTHZ_MODE=dual  # or permission_only

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

ログインしてレビューを書く

同じリポジトリのスキル

概要と使いどころ

007

無料

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

日本語の概要は準備中です。原文の説明を表示しています。