feat: rebuild web UI on the shared theta42 app stack; OIDC + local admin auth

The web management UI was a bespoke minimal theme with LDAP-bind login. Rebuild it to match the SSO Manager and Proxy — same stack, same look/feel, same auth model. The SSH bridge, audit, metrics, and access logic are unchanged; this is purely the web layer. Frontend (mirrors proxy/sso): - Express + EJS with the shared top.ejs/bottom.ejs shell, Bootstrap 5, jQuery, jq-repeat, FontAwesome, Socket.IO, and the shared app-base.js / val.js client framework (copied verbatim). Vendor libs served from node_modules via /static-modules; app assets via /static. - Dashboard / Sessions / Audit pages render in the common look/feel, loading data through the authenticated /api/* endpoints. Auth (mirrors proxy): - OIDC against the SSO (utils/oidc.js + routes/auth.js + models/oidc_state) plus a local anti-lockout admin (models/user_redis.js, bootstrapped from auth.adminUsers[0] / auth.localAdminPass). AuthToken sessions carry the group snapshot; middleware gates the data API on adminGroups or the local admin. New config: oidc{} + auth.adminUsers/localAdminPass. - /api/user/me drives the client login state; "Log in with SSO" hidden when oidc.enabled is false. Verified end to end: local admin login -> token -> /api/user/me isAdmin, metrics/sessions/audit 200 with token / 401 without / 401 bad password; static + page shells serve; 26 tests green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-23 20:57:34 -04:00
parent eb8e5b409e
commit aa3b3ed515
38 changed files with 2550 additions and 374 deletions
@@ -1,42 +1,111 @@
 'use strict';

-// Web login: LDAP bind as the user, require an adminGroups membership, mint a
-// session cookie. (OIDC against the SSO is a follow-up.)
-
-const express = require('express');
+const router = require('express').Router();
+const { rateLimit } = require('express-rate-limit');
 const conf = require('@simpleworkjs/conf');
-const userLdap = require('../models/user_ldap');
-const Session = require('../models/session');
+const { Auth } = require('../models/auth');
+const { OidcState } = require('../models/oidc_state');
+const oidc = require('../utils/oidc');
+const { safeInternalPath } = require('../utils/safe_redirect');

-const router = express.Router();
-
-router.get('/login', (req, res) => {
-	res.render('login', { error: null, name: conf.name });
+// Throttle unauthenticated auth endpoints (credential login + the OIDC
+// handshake) to blunt brute-force / callback abuse. Keyed per IP.
+const authLimiter = rateLimit({
+	windowMs: 15 * 60 * 1000,   // 15 minutes
+	max: 60,                    // 60 attempts per IP per window
+	standardHeaders: true,
+	legacyHeaders: false,
+	message: {name: 'TooManyRequests', message: 'Too many attempts, please try again later.'},
 });

-router.post('/login', express.urlencoded({ extended: false }), async (req, res) => {
-	const { uid, password } = req.body || {};
-	const fail = (msg) => res.status(401).render('login', { error: msg, name: conf.name });
-	try {
-		const user = await userLdap.getUser(uid);
-		if (!user) return fail('Invalid credentials.');
-		const ok = await userLdap.checkPassword(user.dn, password);
-		if (!ok) return fail('Invalid credentials.');
-		const groups = await userLdap.getGroups(user.dn);
-		const admin = (conf.auth.adminGroups || []).some((g) => groups.includes(g));
-		if (!admin) return fail('Your account is not a jump-host admin.');

-		const session = await Session.start(user.uid, groups, conf.auth.sessionTTLms);
-		res.setHeader('Set-Cookie', `jump_session=${session.token}; HttpOnly; SameSite=Lax; Path=/; Max-Age=${Math.floor(conf.auth.sessionTTLms / 1000)}`);
-		res.redirect('/');
-	} catch (err) {
-		return fail('Login failed.');
+router.post('/login', authLimiter, async function(req, res, next){
+	try{
+		let auth = await Auth.login(req.body);
+		return res.json({
+			login: true,
+			token: auth.token.token,
+			message:`${req.body.username} logged in!`,
+		});
+	}catch(error){
+		next(error);
 	}
 });

-router.post('/logout', (req, res) => {
-	res.setHeader('Set-Cookie', 'jump_session=; HttpOnly; Path=/; Max-Age=0');
-	res.redirect('/login');
+router.all('/logout', async function(req, res, next){
+	try{
+		if(req.user){
+			await req.user.logout();
+		}
+
+		res.json({message: 'Bye'})
+	}catch(error){
+		next(error);
+	}
+});
+
+/**
+ * OIDC login start: create a PKCE + state challenge, persist it (auto-expiring
+ * via OidcState TTL), and redirect the browser to the SSO authorize endpoint.
+ */
+router.get('/oidc/start', authLimiter, async function(req, res, next){
+	try{
+		if(!conf.oidc || !conf.oidc.enabled){
+			let error = new Error('OidcDisabled');
+			error.status = 404;
+			error.message = 'OIDC login is not enabled.';
+			throw error;
+		}
+
+		let {state, codeVerifier, codeChallenge} = oidc.createAuthRequest();
+		await OidcState.create({
+			state,
+			codeVerifier,
+			// Sanitize now so a hostile ?redirect= can't be stored and later
+			// reflected into the login page's navigation.
+			redirect: safeInternalPath(req.query.redirect || '/'),
+		});
+
+		return res.redirect(oidc.buildAuthUrl(state, codeChallenge));
+	}catch(error){
+		next(error);
+	}
+});
+
+/**
+ * OIDC callback: validate state (consuming the one-time record), exchange the
+ * code for tokens, read identity from userinfo, establish a session, and hand
+ * the app token back to the browser via a URL fragment for the login page to
+ * store in localStorage.
+ */
+router.get('/oidc/callback', authLimiter, async function(req, res, next){
+	try{
+		let {code, state} = req.query;
+		if(!code || !state){
+			let error = new Error('OidcCallbackInvalid');
+			error.status = 400;
+			error.message = 'Missing code or state.';
+			throw error;
+		}
+
+		// get() throws if the state is unknown or has expired — this both binds
+		// the callback to our request and bounds replay.
+		let saved = await OidcState.get(state);
+		await saved.remove();
+
+		let tokens = await oidc.exchangeCode(code, saved.codeVerifier);
+		let claims = await oidc.fetchUserInfo(tokens.access_token);
+		let identity = oidc.claimsToIdentity(claims);
+
+		let {token} = await Auth.oidcSession(identity);
+
+		let redirect = safeInternalPath(saved.redirect || '/');
+		return res.redirect(
+			`/login#token=${encodeURIComponent(token.token)}&redirect=${encodeURIComponent(redirect)}`
+		);
+	}catch(error){
+		next(error);
+	}
 });

 module.exports = router;