feat: Add demo mode with restricted user actions

docker-compose-dev.yml

@@ -44,6 +44,7 @@ services:
       # - STORAGE_LIMIT=
       # - ACTIVE_USER_LIMIT=
       # - CUSTOMER_PANEL_URL=
+      # - DEMO_MODE=true
 
       # Set to true to show more detailed authentication error messages.
       # It should not be enabled without a rate limiter for security reasons.

docker-compose.yml

@@ -58,6 +58,7 @@ services:
       # - STORAGE_LIMIT=
       # - ACTIVE_USER_LIMIT=
       # - CUSTOMER_PANEL_URL=
+      # - DEMO_MODE=true
 
       # Set to true to show more detailed authentication error messages.
       # It should not be enabled without a rate limiter for security reasons.

server/.env.sample

@@ -35,6 +35,7 @@ SECRET_KEY=notsecretkey
 # STORAGE_LIMIT=
 # ACTIVE_USER_LIMIT=
 # CUSTOMER_PANEL_URL=
+# DEMO_MODE=true
 
 # Set to true to show more detailed authentication error messages.
 # It should not be enabled without a rate limiter for security reasons.

server/api/controllers/users/update-email.js

@@ -134,7 +134,11 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
-    if (user.email === sails.config.custom.defaultAdminEmail || user.isSsoUser) {
+    if (
+      user.email === sails.config.custom.defaultAdminEmail ||
+      user.isSsoUser ||
+      sails.config.custom.demoMode
+    ) {
       throw Errors.NOT_ENOUGH_RIGHTS;
     }
 

server/api/controllers/users/update-password.js

@@ -136,7 +136,11 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
-    if (user.email === sails.config.custom.defaultAdminEmail || user.isSsoUser) {
+    if (
+      user.email === sails.config.custom.defaultAdminEmail ||
+      user.isSsoUser ||
+      sails.config.custom.demoMode
+    ) {
       throw Errors.NOT_ENOUGH_RIGHTS;
     }
 

server/api/controllers/users/update-username.js

@@ -132,7 +132,7 @@ module.exports = {
       throw Errors.USER_NOT_FOUND;
     }
 
-    if (user.email === sails.config.custom.defaultAdminEmail) {
+    if (user.email === sails.config.custom.defaultAdminEmail || sails.config.custom.demoMode) {
       throw Errors.NOT_ENOUGH_RIGHTS;
     }
 

server/api/controllers/users/update.js

@@ -244,7 +244,7 @@ module.exports = {
     }
 
     // TODO: refactor
-    if (user.email === sails.config.custom.defaultAdminEmail) {
+    if (user.email === sails.config.custom.defaultAdminEmail || sails.config.custom.demoMode) {
       if (inputs.role || inputs.name) {
         throw Errors.NOT_ENOUGH_RIGHTS;
       }

server/api/helpers/users/present-one.js

@@ -53,7 +53,9 @@ module.exports = {
         const isDefaultAdmin = inputs.record.email === sails.config.custom.defaultAdminEmail;
 
         const lockedFieldNames = [];
-        if (isDefaultAdmin || inputs.record.isSsoUser) {
+        if (sails.config.custom.demoMode) {
+          lockedFieldNames.push('email', 'password', 'role', 'name', 'username');
+        } else if (isDefaultAdmin || inputs.record.isSsoUser) {
           lockedFieldNames.push('email', 'password', 'name');
 
           if (isDefaultAdmin) {

server/config/custom.js

@@ -63,6 +63,7 @@ module.exports.custom = {
   storageLimit: envToBytes(process.env.STORAGE_LIMIT),
   activeUserLimit: envToNumber(process.env.ACTIVE_USER_LIMIT),
   customerPanelUrl: process.env.CUSTOMER_PANEL_URL,
+  demoMode: process.env.DEMO_MODE === 'true',
 
   showDetailedAuthErrors: process.env.SHOW_DETAILED_AUTH_ERRORS === 'true',