feat(auth): add configurable admin group name for OAuth user access

.env.demo

@@ -78,6 +78,7 @@ AUTH_ENABLED=true
 SESSION_SECRET=b39fd43f68d0491ca942f28a16e484b1e763fe9accf4445ca2669a5f3b179eb4
 ADMIN_USERNAME=admin
 ADMIN_PASSWORD=your_secure_password
+ADMIN_GROUP_NAME=admin
 
 # **OpenID Connect/Authentik Settings**
 AUTHENTIK_CLIENT_ID=<yourAuthentikAppClientID>

app/auth.py

@@ -117,7 +117,8 @@ if AUTH_ENABLED:
             if "groups" in user_data:
                 # Check if user is in admin group
                 groups = user_data.get("groups", [])
-                is_admin = "admin" in groups or "administrators" in groups
+                admin_group = (settings.admin_group_name or "admin").strip().lower()
+                is_admin = admin_group in [group.lower() for group in groups]
 
             # Set is_admin flag (defaults to False for OAuth users unless they're in admin group)
             user_data["is_admin"] = is_admin

app/config.py

@@ -47,6 +47,7 @@ class Settings(BaseSettings):
     admin_username: Optional[str] = None
     admin_password: Optional[str] = None
     session_secret: Optional[str] = None
+    admin_group_name: str = "admin"
 
     # Authentik
     authentik_client_id: Optional[str] = None

docs/AuthenticationSetup.md

@@ -10,6 +10,7 @@ This guide explains how to configure authentication for DocuElevate to secure yo
 | `SESSION_SECRET`           | Secret key for session encryption (min 32 characters)    |
 | `ADMIN_USERNAME`           | Username for basic authentication                        |
 | `ADMIN_PASSWORD`           | Password for basic authentication                        |
+| `ADMIN_GROUP_NAME`         | OIDC group name that grants admin access (default: `admin`) |
 | `AUTHENTIK_CLIENT_ID`      | Client ID for OpenID Connect authentication              |
 | `AUTHENTIK_CLIENT_SECRET`  | Client secret for OpenID Connect authentication          |
 | `AUTHENTIK_CONFIG_URL`     | OpenID Connect discovery URL                             |
@@ -63,6 +64,7 @@ For smaller deployments or testing, simple authentication is easy to set up:
    SESSION_SECRET=your-secure-random-string-at-least-32-chars
    ADMIN_USERNAME=your_admin_username
    ADMIN_PASSWORD=your_secure_password
+   ADMIN_GROUP_NAME=admin
    ```
 
 2. Restart DocuElevate to apply the changes

docs/ConfigurationGuide.md

@@ -93,6 +93,7 @@ DocuElevate can monitor multiple IMAP mailboxes for document attachments. Each m
 | `SESSION_SECRET`        | Secret key used to encrypt sessions and cookies (at least 32 chars). |
 | `ADMIN_USERNAME`        | Username for basic authentication (when not using OIDC).     |
 | `ADMIN_PASSWORD`        | Password for basic authentication (when not using OIDC).     |
+| `ADMIN_GROUP_NAME`      | Group name in OIDC claims that grants admin access. Default: `admin`. |
 | `AUTHENTIK_CLIENT_ID`   | Client ID for Authentik OAuth2/OIDC authentication.          |
 | `AUTHENTIK_CLIENT_SECRET` | Client secret for Authentik OAuth2/OIDC authentication.    |
 | `AUTHENTIK_CONFIG_URL`  | Configuration URL for Authentik OpenID Connect.             |
@@ -519,6 +520,7 @@ AUTH_ENABLED=true
 SESSION_SECRET=a-very-long-and-secure-random-secret-key-string-for-session-encryption
 ADMIN_USERNAME=admin
 ADMIN_PASSWORD=your_secure_password
+ADMIN_GROUP_NAME=admin
 AUTHENTIK_CLIENT_ID=...
 AUTHENTIK_CLIENT_SECRET=...
 AUTHENTIK_CONFIG_URL=https://auth.example.com/.well-known/openid-configuration

docs/SettingsManagement.md

@@ -198,7 +198,7 @@ Settings are stored in the `application_settings` table with:
 - **Check authentication**: Make sure you're logged in
 - **Check admin status**: 
   - Local auth: Verify `ADMIN_USERNAME` and `ADMIN_PASSWORD` are correct
-  - OAuth: Verify your user is in the admin group
+  - OAuth: Verify your user is in the admin group (configurable via `ADMIN_GROUP_NAME`)
 - **Check logs**: Look for "Non-admin user attempted to access settings page" messages
 
 ### Settings Not Taking Effect