jramos/cve-dashboard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Hide admin-only actions from non-Admin activity feed

Browse Source 
Non-Admin users should not see user management events (create, delete,
group changes, password resets), impersonation events, or admin-only
compliance operations (config reconcile, upload rollback) in the
Recent Activity panel.
This commit is contained in:
Jordan Ramos
2026-06-24 17:01:49 -06:00
parent c060133aeb
commit 221eb6a1a1
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
backend/server.js
View File

@@ -164,7 +164,14 @@ app.get('/api/recent-activity', requireAuth(), async (req, res) => {
// Hide impersonation events from non-Admin users
const excludedActions = ['login', 'logout', 'login_failed'];
if (req.user.group !== 'Admin') {
excludedActions.push('impersonate_start', 'impersonate_stop');
// Hide admin-only actions from non-Admin users
excludedActions.push(
'impersonate_start', 'impersonate_stop',
'create_user', 'delete_user', 'update_user',
'added_user', 'deleted_user', 'group_change',
'toggle_active', 'password_reset',
'compliance_config_reconcile', 'compliance_upload_rollback'
);
}
const { rows } = await pool.query(
`SELECT username, action, entity_type, entity_id, details, created_at