diff --git a/nodejs/app.js b/nodejs/app.js index cd06995..eb7d128 100644 --- a/nodejs/app.js +++ b/nodejs/app.js @@ -10,6 +10,11 @@ const app = express(); app.set('view engine', 'ejs'); app.set('views', require('path').join(__dirname, 'views')); +// Per-app values for the shared UI shell (views/top.ejs + views/bottom.ejs). +// Set as an app local so every res.render has it, including routes that don't +// spread the render router's `values` object. +app.locals.ui = require('./utils/ui'); + app.use(compression()); app.use(express.json()); app.use(express.urlencoded({extended: false})); diff --git a/nodejs/package-lock.json b/nodejs/package-lock.json index e9b0d71..c358626 100644 --- a/nodejs/package-lock.json +++ b/nodejs/package-lock.json @@ -1,12 +1,12 @@ { "name": "t42-jump-host", - "version": "1.1.0", + "version": "1.2.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "t42-jump-host", - "version": "1.1.0", + "version": "1.2.0", "license": "MIT", "dependencies": { "@fortawesome/fontawesome-free": "^7.3.0", @@ -22,7 +22,7 @@ "express": "^5.2.1", "express-rate-limit": "^8.5.2", "jq-repeat": "^2.2.0", - "jquery": "^3.7.1", + "jquery": "^4.0.0", "ldapts": "^8.1.8", "model-redis": "^1.6.0", "moment": "^2.30.1", @@ -1186,9 +1186,9 @@ } }, "node_modules/jquery": { - "version": "3.7.1", - "resolved": "https://registry.npmjs.org/jquery/-/jquery-3.7.1.tgz", - "integrity": "sha512-m4avr8yL8kmFN8psrbFFFmB/If14iN5o9nw/NgnnM+kybDJpRsAynV2BsfpTYrTRysYUdADVD7CkUUizgkpLfg==", + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/jquery/-/jquery-4.0.0.tgz", + "integrity": "sha512-TXCHVR3Lb6TZdtw1l3RTLf8RBWVGexdxL6AC8/e0xZKEpBflBsjh9/8LXw+dkNFuOyW9B7iB3O1sP7hS0Kiacg==", "license": "MIT" }, "node_modules/ldapts": { diff --git a/nodejs/package.json b/nodejs/package.json index 35c61b5..162f13c 100644 --- a/nodejs/package.json +++ b/nodejs/package.json @@ -32,7 +32,7 @@ "express": "^5.2.1", "express-rate-limit": "^8.5.2", "jq-repeat": "^2.2.0", - "jquery": "^3.7.1", + "jquery": "^4.0.0", "ldapts": "^8.1.8", "model-redis": "^1.6.0", "moment": "^2.30.1", diff --git a/nodejs/public/css/styles.css b/nodejs/public/css/styles.css index 804357f..a34ad78 100755 --- a/nodejs/public/css/styles.css +++ b/nodejs/public/css/styles.css @@ -18,3 +18,7 @@ body { .card-title{ font-weight: bold; } + +.group-required{ + display: none; +} diff --git a/nodejs/public/lib/js/app-base.js b/nodejs/public/lib/js/app-base.js index 86eac3c..2b323a3 100644 --- a/nodejs/public/lib/js/app-base.js +++ b/nodejs/public/lib/js/app-base.js @@ -1,3 +1,12 @@ +// Shared client framework for the theta42 apps. +// +// This file is byte-identical across sso-manager-node, proxy and jump-host — +// per-app behaviour comes from the server (the `ui` locals in views/top.ejs and +// the /api/user/me response), never from edits to this file. Edit all three +// copies together. +// +// jQuery 4 safe: no $.isFunction, no $.holdReady. + var app = {}; app.pubsub = (function(){ @@ -45,7 +54,7 @@ app.pubsub = (function(){ app.socket = (function(app){ // $.getScript('/socket.io/socket.io.js') // - + var socket; $(document).ready(function(){ socket = io({ @@ -75,10 +84,26 @@ app.socket = (function(app){ app.api = (function(app){ var baseURL = '/api/' - function post(url, data, callback){ - if(typeof callback !== 'function') callback = callback2; + // post/put/delete are dual-mode: pass a callback for the node-style + // (error, data, status) form, or omit it to get a Promise that resolves + // with the parsed body and rejects with the error body. get/options return + // the jqXHR, which is itself thenable, so `await app.api.get(...)` works. + + function body(method, url, data, callback){ + if(typeof callback !== 'function'){ + return new Promise(function(resolve, reject){ + $.ajax({ + type: method, + url: baseURL+url, + headers: { 'auth-token': app.auth.getToken() }, + data: JSON.stringify(data), + contentType: 'application/json; charset=utf-8', + dataType: 'json', + }).done(resolve).fail(function(xhr){ reject(xhr.responseJSON || {}); }); + }); + } return $.ajax({ - type: 'POST', + type: method, url: baseURL+url, headers:{ 'auth-token': app.auth.getToken() @@ -87,40 +112,37 @@ app.api = (function(app){ contentType: "application/json; charset=utf-8", dataType: "json", complete: function(res, text){ - callback ? callback( + callback( text !== 'success' ? res.statusText : null, JSON.parse(res.responseText), res.status - ) : function(){} + ); } }); } + function post(url, data, callback){ + return body('POST', url, data, callback); + } + function put(url, data, callback){ - if(typeof callback !== 'function') callback = callback2; - return $.ajax({ - type: 'PUT', - url: baseURL+url, - headers:{ - 'auth-token': app.auth.getToken() - }, - data: JSON.stringify(data), - contentType: "application/json; charset=utf-8", - dataType: "json", - complete: function(res, text){ - callback ? callback( - text !== 'success' ? res.statusText : null, - JSON.parse(res.responseText), - res.status - ) : function(){} - } - }); + return body('PUT', url, data, callback); } - function remove(url, callback, callback2){ - if(typeof callback !== 'function') callback = callback2; + function remove(url, callback){ + if(typeof callback !== 'function'){ + return new Promise(function(resolve, reject){ + $.ajax({ + type: 'DELETE', + url: baseURL+url, + headers: { 'auth-token': app.auth.getToken() }, + contentType: 'application/json; charset=utf-8', + dataType: 'json', + }).done(resolve).fail(function(xhr){ reject(xhr.responseJSON || {}); }); + }); + } return $.ajax({ - type: 'delete', + type: 'DELETE', url: baseURL+url, headers:{ 'auth-token': app.auth.getToken() @@ -128,11 +150,11 @@ app.api = (function(app){ contentType: "application/json; charset=utf-8", dataType: "json", complete: function(res, text){ - callback ? callback( + callback( text !== 'success' ? res.statusText : null, JSON.parse(res.responseText), res.status - ) : function(){} + ); } }); } @@ -179,7 +201,11 @@ app.api = (function(app){ })(app) app.auth = (function(app){ - var user = {} + // One in-flight/cached GET /api/user/me per page load. Every gating + // decision (nav items, per-view forceLogin, group-required elements) reads + // this same promise instead of re-fetching. + var userPromise = null; + function setToken(token){ localStorage.setItem('APIToken', token); } @@ -188,18 +214,95 @@ app.auth = (function(app){ return localStorage.getItem('APIToken'); } - function isLoggedIn(callback){ - if(getToken()){ - return app.api.get('user/me', function(error, data){ - // data now carries effective rights (isAdmin, global, domains). - if(!error) app.auth.user = app.auth.perms = data; - return callback(error, data); - }); - }else{ - callback(null, false); + async function getUser(){ + try{ + return await app.api.get('user/me'); + }catch(error){ + if(error && error.status === 401) return null; + throw error; } } + // Cached current user, or false when there's no token at all. Callers that + // need a fresh copy (after a login or a profile change) pass force. + function loadUser(force){ + if(force || !userPromise){ + userPromise = getToken() ? getUser() : Promise.resolve(null); + userPromise = userPromise.then(function(user){ + app.auth.user = app.auth.perms = user || null; + return user; + }); + } + return userPromise; + } + + // The apps report group membership two ways: sso-manager-node returns LDAP + // DNs in `memberOf`, the OIDC clients return plain CNs in `groups`. Both + // normalise to a list of CNs. `isAdmin` (the clients' effective-rights flag) + // is exposed as a synthetic `admin` group so one gating model covers both. + function groupCNs(user){ + var raw = (user && (user.memberOf || user.groups)) || []; + if(!Array.isArray(raw)) raw = [raw]; + var names = raw.map(function(group){ + return String(group).split(',')[0].replace(/^cn=/i, ''); + }); + if(user && user.isAdmin && names.indexOf('admin') === -1) names.push('admin'); + return names; + } + + async function memberOf(groupNameToFind, user){ + user = user || await loadUser(); + if(!user) return false; + groupNameToFind = Array.isArray(groupNameToFind) ? groupNameToFind : [groupNameToFind]; + + return groupCNs(user).some(function(group){ + return groupNameToFind.includes(group); + }); + } + + // True when the logged-in user is a global admin (per user/me). Sync — only + // meaningful once isLoggedIn/forceLogin has resolved. + function isAdmin(){ + return !!(app.auth.perms && app.auth.perms.isAdmin); + } + + // Dual-mode: returns a Promise resolving to the user (or false), and calls + // an optional node-style callback with the same result. + function isLoggedIn(callback){ + var promise = loadUser().then(function(user){ + return user || false; + }); + + if(typeof callback === 'function'){ + promise.then(function(user){ + callback(null, user); + }, function(error){ + callback(error, false); + }); + } + + return promise; + } + + function logIn(args, callback){ + app.api.post('auth/login', args, function(error, data){ + if(data.login){ + setToken(data.token); + } + loadUser(true); + callback(error, !!data.token); + }); + } + + // Clears the session only — the caller decides where to go next (the nav's + // Log Out button uses ui.logoutRedirect). + function logOut(callback){ + localStorage.removeItem('APIToken'); + userPromise = null; + app.auth.user = app.auth.perms = null; + if(typeof callback === 'function') callback(); + } + // Constrain a redirect target to a same-origin absolute path. Rejects // absolute URLs (open redirect), protocol-relative "//host" and "/\host", // and non-path schemes like "javascript:" (XSS). Falls back to "/". @@ -230,48 +333,66 @@ app.auth = (function(app){ return true; } - // True when the logged-in user is a global admin (per user/me). - function isAdmin(){ - return !!(app.auth.perms && app.auth.perms.isAdmin); - } - - function logIn(args, callback){ - app.api.post('auth/login', args, function(error, data){ - if(data.login){ - setToken(data.token); - } - callback(error, !!data.token); - }); - } - - function logOut(callback){ - localStorage.removeItem('APIToken'); - callback(); - } - - function forceLogin(){ - // jQuery 4 removed $.holdReady; rely on the redirect below to keep an - // unauthenticated user off the page instead of pausing document ready. - app.auth.isLoggedIn(function(error, isLoggedIn){ - if(error || !isLoggedIn){ - app.auth.logOut(function(){}) - var path = location.href.replace(location.origin, ''); - location.replace('/login?redirect=' + encodeURIComponent(path)); - } - }); + // Page-level gate. jQuery 4 removed $.holdReady, so an unauthenticated or + // unauthorised user is kept off the page by a redirect / an error panel + // rather than by pausing document ready. + // + // `requiredGroups` is a group CN or an OR-list of them; the synthetic + // `admin` group covers the OIDC clients' isAdmin flag. + async function forceLogin(requiredGroups){ + var user = await loadUser(); + + if(!user){ + logOut(function(){}); + location.replace('/login?redirect=' + encodeURIComponent( + location.pathname + location.search + )); + return false; + } + + if(user.onboardingRequired && location.pathname !== '/onboarding'){ + location.replace('/onboarding'); + return false; + } + + if(requiredGroups && !await memberOf(requiredGroups, user)){ + app.util.actionMessage( + `

+ + You do not have permission to be here. + +

`, + $('#spa-shell'), + 'danger', + ); + throw new Error("User does not have permission"); + } + + return user; } + // Where to go after a successful login: the ?redirect= query param, or the + // legacy /login/ suffix form, constrained to a same-origin path. function logInRedirect(){ var params = new URLSearchParams(location.search); - window.location.href = safeInternalPath(params.get('redirect') || '/'); + var target = params.get('redirect') + || location.href.replace(location.origin + '/login', '').split('?')[0] + || '/'; + window.location.href = safeInternalPath(target); } return { getToken: getToken, setToken: setToken, - isLoggedIn: isLoggedIn, - consumeTokenFragment: consumeTokenFragment, + getUser: getUser, + loadUser: loadUser, + groupCNs: groupCNs, + memberOf: memberOf, isAdmin: isAdmin, + isLoggedIn: isLoggedIn, + safeInternalPath: safeInternalPath, + consumeTokenFragment: consumeTokenFragment, + user: null, perms: null, logIn: logIn, logOut: logOut, @@ -281,6 +402,11 @@ app.auth = (function(app){ })(app); +// Back-compat alias for views that awaited the cached user directly. +Object.defineProperty(app.auth, 'asyncUser', { + get: function(){ return app.auth.loadUser(); }, +}); + app.user = (function(app){ function list(callback){ app.api.get('user/?detail=true', function(error, data){ @@ -310,6 +436,8 @@ app.user = (function(app){ })(app); +// Local (app-managed) permissions and groups. Only the OIDC-client apps serve +// these endpoints; the calls are inert elsewhere. app.permission = (function(app){ function list(callback){ app.api.get('permission/', function(error, data){ @@ -383,9 +511,12 @@ app.util = (function(app){ return results === null ? '' : decodeURIComponent(results[1].replace(/\+/g, ' ')); }; - function actionMessage(message, $target, type, callback){ + function actionMessage(message, $targetPassed, type, callback){ message = message || ''; - $target = $target.closest('div.card').find('.actionMessage'); + + let $target = $targetPassed.closest('div.card').find('.actionMessage'); + if(!$target.length) $target = $($targetPassed.find('.actionMessage')[0]); + type = type || 'info'; callback = callback || function(){}; @@ -402,12 +533,48 @@ app.util = (function(app){ }) }else{ if(type) $target.addClass('bg-' + type); - message = '' + message + '' + + // Messages that bring their own buttons (actionConfirm) are left + // alone; everything else gets the standard dismiss button. + if(!message.includes('${message} + + ` $target.html(message).slideDown('fast'); } setTimeout(callback,10) } + function actionConfirm(message, $target, type, callback){ + return new Promise((resolve, reject) =>{ + let id = crypto.randomUUID(); + message = ` +

+ + ${message} + + + + +

+ ` + actionMessage(message, $target, type); + $("body").on('click', `.confirm-${id}`, function(){ + actionMessage('', $target, type); + resolve(!!$(this).data('confirm')); + }); + }); + + } + $.fn.serializeObject = function() { var obj = {}; @@ -464,11 +631,42 @@ app.util = (function(app){ return { downloadFile: downloadFile, getUrlParameter: getUrlParameter, - actionMessage: actionMessage + actionMessage: actionMessage, + actionConfirm, } })(app); -$( document ).ready(function(){ +// Reveal every .group-required- element the current user's groups entitle +// them to. Elements carrying .group-required start hidden (styles.css), so a +// user who is in no groups — or who isn't logged in — simply never sees them. +app.auth.applyGroupVisibility = function(user){ + var groups = app.auth.groupCNs(user); + if(!groups.length) return; + + var style = document.getElementById('group-required-rules'); + if(!style){ + style = document.createElement('style'); + style.id = 'group-required-rules'; + document.head.appendChild(style); + } + + for(var group of groups){ + try{ + style.sheet.insertRule( + `.group-required-${CSS.escape(group)} { display: revert !important; }`, + style.sheet.cssRules.length + ); + }catch(error){ + // A group whose CN isn't a usable CSS identifier just gates nothing. + } + } +}; + +$( document ).ready(async function(){ + + // Show content the user's groups entitle them to. + app.auth.applyGroupVisibility(await app.auth.loadUser()); + $('div.row').fadeIn('slow'); //show the page //panel button's @@ -522,12 +720,14 @@ function formAJAX(btn){ var method = ($form.attr('method') || 'post').toLowerCase(); if($form.validate && !$form.validate()){ - app.util.actionMessage('Please fix the form errors.', $form, 'danger'); + app.util.actionMessage('Please fix the form errors.', $form, 'danger') return false; } - - app.util.actionMessage( - '', + + app.util.actionMessage( + ``, $form, 'info' ); diff --git a/nodejs/utils/ui.js b/nodejs/utils/ui.js new file mode 100644 index 0000000..1596c95 --- /dev/null +++ b/nodejs/utils/ui.js @@ -0,0 +1,42 @@ +'use strict'; + +// Per-app values for the shared UI shell (views/top.ejs + views/bottom.ejs). +// +// Those two partials are byte-identical across sso-manager-node, proxy and +// jump-host — everything that differs between the apps lives here and is +// exposed to every render as `ui` via app.locals (see app.js). Keep the key set +// in sync across the three apps; a missing key is a render-time ReferenceError, +// not a silent fallback. + +module.exports = { + // --- footer ------------------------------------------------------------- + repoUrl: 'https://github.com/theta42/jump-host', + licenseUrl: 'https://github.com/theta42/jump-host/blob/master/LICENSE', + // No in-app /docs route here — point at the published docs site. + docsUrl: 'https://theta42.github.io/jump-host/', + docsExternal: true, + // Only sso-manager-node serves a Terms of Service page; null hides the link. + tosUrl: null, + + // --- header / nav ------------------------------------------------------- + faviconUrl: '/static/favicon.svg', + // Where the current-user chip links. null renders it as a plain span (for + // apps with no profile page). + profileUrl: null, + // Where "Log Out" lands. + logoutRedirect: '/login', + // Admin-only "a newer release is available" banner, backed by + // GET /api/update-check. Apps without that endpoint set false. + updateCheck: false, + updateLabel: 'the jump host', + + // Nav items, in order. `groups` is an OR-list of group CNs that may see the + // item; an empty list means "always visible". Gating is done client-side by + // app-base.js, which reveals .group-required- for each group the user is + // in (plus the synthetic `admin` group when user/me reports isAdmin). + nav: [ + {href: '/dashboard', icon: 'fa-solid fa-gauge-high', label: 'Dashboard', groups: []}, + {href: '/sessions', icon: 'fa-solid fa-plug-circle-bolt', label: 'Sessions', groups: []}, + {href: '/audit', icon: 'fa-solid fa-clipboard-list', label: 'Audit', groups: []}, + ], +}; diff --git a/nodejs/views/bottom.ejs b/nodejs/views/bottom.ejs index 6daa39c..a2dadd8 100644 --- a/nodejs/views/bottom.ejs +++ b/nodejs/views/bottom.ejs @@ -1,24 +1,30 @@ - + - + + diff --git a/nodejs/views/top.ejs b/nodejs/views/top.ejs index 5fd9ad3..cc3c1cf 100644 --- a/nodejs/views/top.ejs +++ b/nodejs/views/top.ejs @@ -4,10 +4,17 @@ <%- name %> <%- title %> - + + + + + + @@ -28,51 +35,115 @@
    -
  • - Dashboard -
    • -
  • - Sessions -
    • -
  • - Audit + <%# Items gated on a group start hidden (.group-required) and are + revealed by app-base.js for the groups the user is in. %> + <% for(const item of ui.nav){ %> +
  • + + <%- item.label %> +
    • + <% } %>
+ <% if(ui.profileUrl){ %> + + <% } else { %> - -
+ <% if(ui.updateCheck){ %> + + + + + <% } %> + -
+ + +
+