Nova
e6ba19fe8e
In production with HTTP, secure cookies are rejected by browsers. Allow HTTP until behind proper HTTPS proxy.
523 lines
16 KiB
JavaScript
523 lines
16 KiB
JavaScript
/**
|
|
* OpenClaw WebUI - Backend Proxy Server
|
|
*
|
|
* Features:
|
|
* - LDAP SSO Authentication
|
|
* - Proxy to OpenClaw Gateway (WebSocket + HTTP)
|
|
* - Session management
|
|
* - Chat history persistence
|
|
*/
|
|
|
|
import express from 'express';
|
|
import session from 'express-session';
|
|
import { createProxyMiddleware } from 'http-proxy-middleware';
|
|
import { WebSocketServer, WebSocket } from 'ws';
|
|
import { createServer } from 'http';
|
|
import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs';
|
|
import { join, dirname } from 'path';
|
|
import { fileURLToPath } from 'url';
|
|
import ldap from 'ldapjs';
|
|
import { v4 as uuidv4 } from 'uuid';
|
|
import conf from './config.js';
|
|
|
|
const __dirname = dirname(fileURLToPath(import.meta.url));
|
|
|
|
// Configuration
|
|
const CONFIG = {
|
|
port: conf.server?.port || 3000,
|
|
gatewayUrl: conf.gateway?.url || 'http://127.0.0.1:18789',
|
|
gatewayToken: conf.gateway?.token || '',
|
|
sessionSecret: conf.session?.secret || 'dev-secret',
|
|
sessionMaxAge: conf.session?.maxAge || 24 * 60 * 60 * 1000,
|
|
authDisabled: conf.auth?.disabled || false,
|
|
ldap: {
|
|
enabled: conf.auth?.ldap?.enabled || false,
|
|
url: conf.auth?.ldap?.url || 'ldap://localhost:389',
|
|
baseDN: conf.auth?.ldap?.baseDN || 'ou=users,dc=example,dc=com',
|
|
bindDN: conf.auth?.ldap?.bindDN || '',
|
|
bindPassword: conf.auth?.ldap?.bindPassword || '',
|
|
searchFilter: conf.auth?.ldap?.searchFilter || '(uid={{username}})'
|
|
},
|
|
dataDir: conf.data?.dir || join(__dirname, '../data'),
|
|
environment: conf.environment
|
|
};
|
|
|
|
// Ensure data directory exists
|
|
if (!existsSync(CONFIG.dataDir)) {
|
|
mkdirSync(CONFIG.dataDir, { recursive: true });
|
|
}
|
|
|
|
// Initialize Express app
|
|
const app = express();
|
|
const server = createServer(app);
|
|
|
|
// Middleware
|
|
app.use(express.json());
|
|
app.use(express.urlencoded({ extended: true }));
|
|
|
|
// Session middleware
|
|
app.use(session({
|
|
secret: CONFIG.sessionSecret,
|
|
resave: false,
|
|
saveUninitialized: false,
|
|
cookie: {
|
|
secure: false, // Allow HTTP (set to true only behind HTTPS proxy)
|
|
maxAge: CONFIG.sessionMaxAge
|
|
}
|
|
}));
|
|
|
|
// CORS for development
|
|
app.use((req, res, next) => {
|
|
res.setHeader('Access-Control-Allow-Origin', '*');
|
|
res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
|
|
res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
|
|
if (req.method === 'OPTIONS') return res.sendStatus(200);
|
|
next();
|
|
});
|
|
|
|
// ==================== LDAP Authentication ====================
|
|
|
|
async function authenticateLDAP(username, password) {
|
|
return new Promise((resolve, reject) => {
|
|
const client = ldap.createClient({
|
|
url: CONFIG.ldap.url,
|
|
timeLimit: 10,
|
|
sizeLimit: 100
|
|
});
|
|
|
|
client.on('error', (err) => {
|
|
console.error('[LDAP] Connection error:', err.message);
|
|
reject(new Error('LDAP connection failed'));
|
|
});
|
|
|
|
// Step 1: Bind with service account (if configured) to search for user
|
|
const doSearch = () => {
|
|
const filter = CONFIG.ldap.searchFilter.replace('{{username}}', username);
|
|
|
|
const searchOptions = {
|
|
scope: 'sub',
|
|
filter: filter,
|
|
attributes: ['dn', 'uid', 'cn', 'mail', 'displayName', 'memberOf']
|
|
};
|
|
|
|
let userDN = null;
|
|
const user = { username };
|
|
let searchComplete = false;
|
|
|
|
const finishSearch = () => {
|
|
if (searchComplete) return;
|
|
searchComplete = true;
|
|
|
|
if (!userDN) {
|
|
client.destroy();
|
|
reject(new Error('User not found'));
|
|
return;
|
|
}
|
|
|
|
// Step 2: Bind as the user to verify password
|
|
client.bind(userDN, password, (err) => {
|
|
if (err) {
|
|
client.destroy();
|
|
reject(new Error('Invalid credentials'));
|
|
return;
|
|
}
|
|
|
|
console.log('[LDAP] Authenticated:', username);
|
|
client.destroy();
|
|
resolve(user);
|
|
});
|
|
};
|
|
|
|
client.search(CONFIG.ldap.baseDN, searchOptions, (err, res) => {
|
|
if (err) {
|
|
client.destroy();
|
|
reject(err);
|
|
return;
|
|
}
|
|
|
|
res.on('searchEntry', (entry) => {
|
|
const pojo = entry.pojo;
|
|
userDN = pojo.objectName;
|
|
user.dn = pojo.objectName;
|
|
for (const attr of pojo.attributes) {
|
|
if (attr.type === 'uid') user.uid = attr.values[0];
|
|
if (attr.type === 'cn') user.cn = attr.values[0];
|
|
if (attr.type === 'mail') user.email = attr.values[0];
|
|
if (attr.type === 'displayName') user.displayName = attr.values[0];
|
|
if (attr.type === 'memberOf') user.groups = attr.values;
|
|
}
|
|
});
|
|
|
|
res.on('error', (err) => {
|
|
console.error('[LDAP] Search error:', err.message);
|
|
client.destroy();
|
|
reject(err);
|
|
});
|
|
|
|
res.on('end', () => finishSearch());
|
|
});
|
|
};
|
|
|
|
if (CONFIG.ldap.bindDN && CONFIG.ldap.bindPassword) {
|
|
client.bind(CONFIG.ldap.bindDN, CONFIG.ldap.bindPassword, (err) => {
|
|
if (err) {
|
|
console.error('[LDAP] Service bind failed:', err.message);
|
|
client.destroy();
|
|
reject(new Error('LDAP service bind failed'));
|
|
return;
|
|
}
|
|
doSearch();
|
|
});
|
|
} else {
|
|
doSearch();
|
|
}
|
|
});
|
|
}
|
|
|
|
// ==================== Auth Routes ====================
|
|
|
|
// Check auth status
|
|
app.get('/api/auth/status', (req, res) => {
|
|
if (CONFIG.authDisabled) {
|
|
return res.json({ authenticated: true, user: { username: 'dev-user', displayName: 'Dev User' } });
|
|
}
|
|
|
|
if (req.session.user) {
|
|
return res.json({ authenticated: true, user: req.session.user });
|
|
}
|
|
|
|
res.json({ authenticated: false });
|
|
});
|
|
|
|
// Login endpoint
|
|
app.post('/api/auth/login', async (req, res) => {
|
|
const { username, password } = req.body;
|
|
|
|
if (!username || !password) {
|
|
return res.status(400).json({ error: 'Username and password required' });
|
|
}
|
|
|
|
// Development bypass
|
|
if (CONFIG.authDisabled) {
|
|
req.session.user = { username, displayName: username };
|
|
return res.json({ success: true, user: req.session.user });
|
|
}
|
|
|
|
// LDAP authentication
|
|
if (CONFIG.ldap.enabled) {
|
|
try {
|
|
const user = await authenticateLDAP(username, password);
|
|
req.session.user = user;
|
|
res.json({ success: true, user });
|
|
} catch (err) {
|
|
res.status(401).json({ error: 'Invalid credentials' });
|
|
}
|
|
return;
|
|
}
|
|
|
|
// Fallback: simple password check (for development without LDAP)
|
|
res.status(401).json({ error: 'LDAP not configured' });
|
|
});
|
|
|
|
// Logout endpoint
|
|
app.post('/api/auth/logout', (req, res) => {
|
|
req.session.destroy();
|
|
res.json({ success: true });
|
|
});
|
|
|
|
// Auth middleware for protected routes
|
|
function requireAuth(req, res, next) {
|
|
if (CONFIG.authDisabled) return next();
|
|
if (!req.session.user) {
|
|
return res.status(401).json({ error: 'Authentication required' });
|
|
}
|
|
next();
|
|
}
|
|
|
|
// ==================== Chat History ====================
|
|
|
|
function getHistoryPath(userId) {
|
|
return join(CONFIG.dataDir, `history-${userId}.json`);
|
|
}
|
|
|
|
function loadHistory(userId) {
|
|
const path = getHistoryPath(userId);
|
|
if (!existsSync(path)) return { conversations: [], messages: {} };
|
|
try {
|
|
return JSON.parse(readFileSync(path, 'utf-8'));
|
|
} catch {
|
|
return { conversations: [], messages: {} };
|
|
}
|
|
}
|
|
|
|
function saveHistory(userId, data) {
|
|
const path = getHistoryPath(userId);
|
|
writeFileSync(path, JSON.stringify(data, null, 2));
|
|
}
|
|
|
|
// Get conversations list
|
|
app.get('/api/conversations', requireAuth, (req, res) => {
|
|
const userId = req.session.user?.username || 'dev-user';
|
|
const history = loadHistory(userId);
|
|
res.json(history.conversations);
|
|
});
|
|
|
|
// Get messages for a conversation
|
|
app.get('/api/conversations/:id/messages', requireAuth, (req, res) => {
|
|
const userId = req.session.user?.username || 'dev-user';
|
|
const history = loadHistory(userId);
|
|
res.json(history.messages[req.params.id] || []);
|
|
});
|
|
|
|
// Create new conversation
|
|
app.post('/api/conversations', requireAuth, (req, res) => {
|
|
const userId = req.session.user?.username || 'dev-user';
|
|
const history = loadHistory(userId);
|
|
|
|
const conv = {
|
|
id: uuidv4(),
|
|
title: req.body.title || 'New Chat',
|
|
createdAt: Date.now(),
|
|
updatedAt: Date.now()
|
|
};
|
|
|
|
history.conversations.unshift(conv);
|
|
history.messages[conv.id] = [];
|
|
saveHistory(userId, history);
|
|
|
|
res.json(conv);
|
|
});
|
|
|
|
// Update conversation
|
|
app.put('/api/conversations/:id', requireAuth, (req, res) => {
|
|
const userId = req.session.user?.username || 'dev-user';
|
|
const history = loadHistory(userId);
|
|
|
|
const conv = history.conversations.find(c => c.id === req.params.id);
|
|
if (!conv) return res.status(404).json({ error: 'Not found' });
|
|
|
|
Object.assign(conv, req.body, { updatedAt: Date.now() });
|
|
saveHistory(userId, history);
|
|
|
|
res.json(conv);
|
|
});
|
|
|
|
// Delete conversation
|
|
app.delete('/api/conversations/:id', requireAuth, (req, res) => {
|
|
const userId = req.session.user?.username || 'dev-user';
|
|
const history = loadHistory(userId);
|
|
|
|
history.conversations = history.conversations.filter(c => c.id !== req.params.id);
|
|
delete history.messages[req.params.id];
|
|
saveHistory(userId, history);
|
|
|
|
res.json({ success: true });
|
|
});
|
|
|
|
// Save message to conversation
|
|
app.post('/api/conversations/:id/messages', requireAuth, (req, res) => {
|
|
const userId = req.session.user?.username || 'dev-user';
|
|
const history = loadHistory(userId);
|
|
|
|
if (!history.messages[req.params.id]) {
|
|
history.messages[req.params.id] = [];
|
|
}
|
|
|
|
const msg = {
|
|
id: uuidv4(),
|
|
role: req.body.role,
|
|
content: req.body.content,
|
|
timestamp: Date.now(),
|
|
...req.body
|
|
};
|
|
|
|
history.messages[req.params.id].push(msg);
|
|
|
|
// Update conversation
|
|
const conv = history.conversations.find(c => c.id === req.params.id);
|
|
if (conv) {
|
|
conv.updatedAt = Date.now();
|
|
// Auto-title from first user message
|
|
if (msg.role === 'user' && history.messages[req.params.id].length === 1) {
|
|
conv.title = msg.content.substring(0, 50) + (msg.content.length > 50 ? '...' : '');
|
|
}
|
|
}
|
|
|
|
saveHistory(userId, history);
|
|
res.json(msg);
|
|
});
|
|
|
|
// ==================== OpenClaw Gateway Proxy ====================
|
|
|
|
// HTTP proxy for OpenAI-compatible endpoints
|
|
app.use('/v1', requireAuth, createProxyMiddleware({
|
|
target: CONFIG.gatewayUrl,
|
|
changeOrigin: true,
|
|
onProxyReq: (proxyReq, req, res) => {
|
|
// Add auth token for OpenClaw gateway
|
|
proxyReq.setHeader('Authorization', `Bearer ${CONFIG.gatewayToken}`);
|
|
proxyReq.setHeader('x-openclaw-agent-id', req.headers['x-openclaw-agent-id'] || 'main');
|
|
|
|
// Re-serialize body if it was already parsed by express.json()
|
|
if (req.body && Object.keys(req.body).length > 0) {
|
|
const bodyData = JSON.stringify(req.body);
|
|
proxyReq.setHeader('Content-Length', Buffer.byteLength(bodyData));
|
|
proxyReq.write(bodyData);
|
|
}
|
|
},
|
|
onProxyRes: (proxyRes, req, res) => {
|
|
// Handle SSE streaming
|
|
if (proxyRes.headers['content-type']?.includes('text/event-stream')) {
|
|
proxyRes.headers['cache-control'] = 'no-cache';
|
|
proxyRes.headers['connection'] = 'keep-alive';
|
|
}
|
|
}
|
|
}));
|
|
|
|
// ==================== File Upload ====================
|
|
|
|
import { createWriteStream } from 'fs';
|
|
import { tmpdir } from 'os';
|
|
|
|
const uploads = new Map();
|
|
|
|
app.post('/api/upload', requireAuth, express.raw({ type: '*/*', limit: '50mb' }), (req, res) => {
|
|
const id = uuidv4();
|
|
const filename = req.query.filename || 'file';
|
|
const mimeType = req.headers['content-type'] || 'application/octet-stream';
|
|
|
|
uploads.set(id, {
|
|
filename,
|
|
mimeType,
|
|
data: req.body,
|
|
uploadedAt: Date.now()
|
|
});
|
|
|
|
// Clean up old uploads (older than 1 hour)
|
|
const now = Date.now();
|
|
for (const [k, v] of uploads) {
|
|
if (now - v.uploadedAt > 3600000) uploads.delete(k);
|
|
}
|
|
|
|
res.json({ id, filename, mimeType, size: req.body.length });
|
|
});
|
|
|
|
app.get('/api/upload/:id', requireAuth, (req, res) => {
|
|
const upload = uploads.get(req.params.id);
|
|
if (!upload) return res.status(404).json({ error: 'Not found' });
|
|
|
|
res.setHeader('Content-Type', upload.mimeType);
|
|
res.setHeader('Content-Disposition', `attachment; filename="${upload.filename}"`);
|
|
res.send(upload.data);
|
|
});
|
|
|
|
// Get upload metadata
|
|
app.get('/api/upload/:id/meta', requireAuth, (req, res) => {
|
|
const upload = uploads.get(req.params.id);
|
|
if (!upload) return res.status(404).json({ error: 'Not found' });
|
|
|
|
res.json({
|
|
id: req.params.id,
|
|
filename: upload.filename,
|
|
mimeType: upload.mimeType,
|
|
size: upload.data.length
|
|
});
|
|
});
|
|
|
|
// ==================== Models & Agents ====================
|
|
|
|
app.get('/api/models', requireAuth, async (req, res) => {
|
|
try {
|
|
const response = await fetch(`${CONFIG.gatewayUrl}/v1/models`, {
|
|
headers: { 'Authorization': `Bearer ${CONFIG.gatewayToken}` }
|
|
});
|
|
const data = await response.json();
|
|
res.json(data);
|
|
} catch (err) {
|
|
res.json({
|
|
data: [
|
|
{ id: 'main', name: 'Main', owned_by: 'openclaw' },
|
|
{ id: 'huihui', name: 'HuiHui MoE', owned_by: 'openclaw' },
|
|
{ id: 'gpt-oss', name: 'GPT-OSS 120B', owned_by: 'openclaw' }
|
|
]
|
|
});
|
|
}
|
|
});
|
|
|
|
// ==================== Static Files ====================
|
|
|
|
// Serve frontend in production
|
|
if (process.env.NODE_ENV === 'production') {
|
|
app.use(express.static(join(__dirname, '../dist')));
|
|
|
|
app.get('*', (req, res) => {
|
|
res.sendFile(join(__dirname, '../dist/index.html'));
|
|
});
|
|
} else {
|
|
// Development mode - proxy to Vite
|
|
app.get('/', (req, res) => {
|
|
res.redirect('http://localhost:5173');
|
|
});
|
|
}
|
|
|
|
// ==================== WebSocket Server ====================
|
|
|
|
const wss = new WebSocketServer({ server, path: '/ws' });
|
|
|
|
wss.on('connection', (ws, req) => {
|
|
console.log('WebSocket client connected');
|
|
|
|
// Connect to OpenClaw gateway
|
|
const gatewayUrl = CONFIG.gatewayUrl.replace('http', 'ws');
|
|
const gatewayWs = new WebSocket(`${gatewayUrl}/ws`);
|
|
|
|
gatewayWs.on('open', () => {
|
|
// Forward client messages to gateway
|
|
ws.on('message', (data) => {
|
|
gatewayWs.send(data);
|
|
});
|
|
});
|
|
|
|
gatewayWs.on('message', (data) => {
|
|
// Forward gateway messages to client
|
|
if (ws.readyState === WebSocket.OPEN) {
|
|
ws.send(data);
|
|
}
|
|
});
|
|
|
|
gatewayWs.on('error', (err) => {
|
|
console.error('Gateway WS error:', err.message);
|
|
});
|
|
|
|
gatewayWs.on('close', () => {
|
|
if (ws.readyState === WebSocket.OPEN) {
|
|
ws.close();
|
|
}
|
|
});
|
|
|
|
ws.on('close', () => {
|
|
gatewayWs.close();
|
|
});
|
|
|
|
ws.on('error', (err) => {
|
|
console.error('Client WS error:', err.message);
|
|
gatewayWs.close();
|
|
});
|
|
});
|
|
|
|
// ==================== Start Server ====================
|
|
|
|
server.listen(CONFIG.port, () => {
|
|
console.log(`
|
|
╔═══════════════════════════════════════════════════════════╗
|
|
║ OpenClaw WebUI Server ║
|
|
╠═══════════════════════════════════════════════════════════╣
|
|
║ Environment: ${(conf.environment || 'development').padEnd(43)}║
|
|
║ Port: ${CONFIG.port.toString().padEnd(43)}║
|
|
║ Gateway: ${CONFIG.gatewayUrl.padEnd(43)}║
|
|
║ LDAP: ${(CONFIG.ldap.enabled ? 'Enabled' : 'Disabled').padEnd(43)}║
|
|
║ Auth: ${(CONFIG.authDisabled ? 'Disabled (dev mode)' : 'Enabled').padEnd(43)}║
|
|
║ Data: ${CONFIG.dataDir.padEnd(43)}║
|
|
╚═══════════════════════════════════════════════════════════╝
|
|
`);
|
|
}); |