feat: Add demo mode with restricted user actions

server/api/controllers/users/update-email.js

@@ -134,7 +134,11 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
-    if (user.email === sails.config.custom.defaultAdminEmail || user.isSsoUser) {
+    if (
+      user.email === sails.config.custom.defaultAdminEmail ||
+      user.isSsoUser ||
+      sails.config.custom.demoMode
+    ) {
       throw Errors.NOT_ENOUGH_RIGHTS;
     }
 

server/api/controllers/users/update-password.js

@@ -136,7 +136,11 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
-    if (user.email === sails.config.custom.defaultAdminEmail || user.isSsoUser) {
+    if (
+      user.email === sails.config.custom.defaultAdminEmail ||
+      user.isSsoUser ||
+      sails.config.custom.demoMode
+    ) {
       throw Errors.NOT_ENOUGH_RIGHTS;
     }
 

server/api/controllers/users/update-username.js

@@ -132,7 +132,7 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
-    if (user.email === sails.config.custom.defaultAdminEmail) {
+    if (user.email === sails.config.custom.defaultAdminEmail || sails.config.custom.demoMode) {
       throw Errors.NOT_ENOUGH_RIGHTS;
     }
 

server/api/controllers/users/update.js

@@ -244,7 +244,7 @@ module.exports = {
     }
 
     // TODO: refactor
-    if (user.email === sails.config.custom.defaultAdminEmail) {
+    if (user.email === sails.config.custom.defaultAdminEmail || sails.config.custom.demoMode) {
       if (inputs.role || inputs.name) {
         throw Errors.NOT_ENOUGH_RIGHTS;
       }

server/api/helpers/users/present-one.js

@@ -53,7 +53,9 @@ module.exports = {
         const isDefaultAdmin = inputs.record.email === sails.config.custom.defaultAdminEmail;
 
         const lockedFieldNames = [];
-        if (isDefaultAdmin || inputs.record.isSsoUser) {
+        if (sails.config.custom.demoMode) {
+          lockedFieldNames.push('email', 'password', 'role', 'name', 'username');
+        } else if (isDefaultAdmin || inputs.record.isSsoUser) {
           lockedFieldNames.push('email', 'password', 'name');
 
           if (isDefaultAdmin) {