feat: rebuild web UI on the shared theta42 app stack; OIDC + local admin auth

The web management UI was a bespoke minimal theme with LDAP-bind login. Rebuild it to match the SSO Manager and Proxy — same stack, same look/feel, same auth model. The SSH bridge, audit, metrics, and access logic are unchanged; this is purely the web layer. Frontend (mirrors proxy/sso): - Express + EJS with the shared top.ejs/bottom.ejs shell, Bootstrap 5, jQuery, jq-repeat, FontAwesome, Socket.IO, and the shared app-base.js / val.js client framework (copied verbatim). Vendor libs served from node_modules via /static-modules; app assets via /static. - Dashboard / Sessions / Audit pages render in the common look/feel, loading data through the authenticated /api/* endpoints. Auth (mirrors proxy): - OIDC against the SSO (utils/oidc.js + routes/auth.js + models/oidc_state) plus a local anti-lockout admin (models/user_redis.js, bootstrapped from auth.adminUsers[0] / auth.localAdminPass). AuthToken sessions carry the group snapshot; middleware gates the data API on adminGroups or the local admin. New config: oidc{} + auth.adminUsers/localAdminPass. - /api/user/me drives the client login state; "Log in with SSO" hidden when oidc.enabled is false. Verified end to end: local admin login -> token -> /api/user/me isAdmin, metrics/sessions/audit 200 with token / 401 without / 401 bad password; static + page shells serve; 26 tests green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-23 20:57:34 -04:00
parent eb8e5b409e
commit aa3b3ed515
38 changed files with 2550 additions and 374 deletions
@@ -0,0 +1,123 @@
+'use strict';
+
+const Table = require('.');
+const bcrypt = require('bcrypt');
+const crypto = require('crypto');
+const conf = require('@simpleworkjs/conf');
+const saltRounds = 10;
+
+class User extends Table{
+	static _key = 'username';
+	static _keyMap = {
+		'created_by': {isRequired: true, type: 'string', min: 3, max: 500},
+		'created_on': {default: function(){return (new Date).getTime()}},
+		'updated_by': {default:"__NONE__", isRequired: false, type: 'string',},
+		'updated_on': {default: function(){return (new Date).getTime()}, always: true},
+		'username': {isRequired: true, type: 'string', min: 3, max: 500},
+		'password': {isRequired: true, type: 'string', min: 3, max: 500, isPrivate: true},
+		'backing': {default:"redis", isRequired: false, type: 'string',},
+	}
+
+	static backing = 'redis'
+
+	static async create(data) {
+		try{
+			data['password'] = await bcrypt.hash(data['password'], saltRounds);
+			data['backing'] = data['backing'] || 'redis';
+
+		return await super.create(data)
+
+		}catch(error){
+			throw error;
+		}
+	}
+
+	async setPassword(data){
+		try{
+			data['password'] = await bcrypt.hash(data['password'], saltRounds);
+
+			return this.update(data);
+		}catch(error){
+			throw error;
+		}
+	}
+
+	/**
+	 * Just-in-time provisioning for an OIDC-authenticated user. Creates the
+	 * local user on first login so relations (tokens, created_by, grants) have
+	 * something to point at. OIDC users get a random, unusable password — they
+	 * authenticate through the SSO, never the local password form.
+	 *
+	 * @param {Object} data - {username, ...} from the OIDC userinfo claims
+	 * @returns {User} the existing or newly created user
+	 */
+	static async upsertOidc(data){
+		try{
+			return await User.get(data.username);
+		}catch(error){
+			return await User.create({
+				username: data.username,
+				password: crypto.randomBytes(24).toString('hex'),
+				created_by: data.username,
+				backing: 'oidc',
+			});
+		}
+	}
+
+	static async login(data){
+		try{
+			let user = await User.get(data);
+			let auth = await bcrypt.compare(data.password, user.password);
+
+			if(auth){
+				return user
+			}else{
+				throw this.errors.login();
+			}
+		}catch(error){
+			console.error('!!!!!!!!!!', error)
+			if (error == 'Authentication failure'){
+				throw this.errors.login()
+			}
+			throw error;
+		}
+	};
+}
+
+User.register();
+
+(async function(){
+	// The anti-lockout local admin: the first entry in conf.auth.adminUsers
+	// (default 'jumpadmin'). A local login that works even if the SSO/OIDC is
+	// unreachable — the whole point of "OIDC + internal users".
+	var defaultUser = (conf.auth && conf.auth.adminUsers && conf.auth.adminUsers[0]) || 'jumpadmin';
+	// Optional: an orchestrator (e.g. theta-env's setup.sh) can set
+	// auth.localAdminPass in jump-secrets.js to a generated password so this
+	// bootstrap account isn't left at a well-known default. Only used on first
+	// creation -- once the account exists this is never read again, so it's
+	// safe to leave set. If unset, a random password is generated and printed
+	// once; save it from the log or set auth.localAdminPass explicitly.
+	var defaultPass = (conf.auth && conf.auth.localAdminPass);
+	if (!defaultPass) {
+		defaultPass = crypto.randomBytes(16).toString('hex');
+		console.warn(`====================================================================`);
+		console.warn(`Bootstrap admin "${defaultUser}" created with random password:`);
+		console.warn(`${defaultPass}`);
+		console.warn(`Set auth.localAdminPass in your secrets file to make this deterministic.`);
+		console.warn(`====================================================================`);
+	}
+	try{
+		let user = await User.get(defaultUser);
+	}catch(error){
+		try{
+			let user = await User.create({
+				username:defaultUser,
+				password: defaultPass,
+				created_by: defaultUser
+			});
+			console.log(defaultUser, 'created');
+		}catch(error){
+			console.error(error)
+		}
+	}
+})();