wmantly
ee76088f86
views/top.ejs, views/bottom.ejs and public/lib/js/app-base.js are now byte-identical across sso-manager-node, proxy and jump-host. Everything per-app moved into utils/ui.js, exposed to every render as `ui` via app.locals (nav items + their group gates, footer repo/docs/ToS links, favicon, profile/logout targets, update-banner on/off + label). Client framework changes: - One gating model everywhere: app-base.js reveals .group-required-<cn> for each of the current user user/me groups. sso-manager-node sends LDAP DNs in memberOf, the OIDC clients send CNs in groups; both normalise to CNs, and the clients isAdmin flag becomes a synthetic `admin` group, so proxy nav-admin items are now group-required-admin. - user/me is fetched once per page load and cached (app.auth.loadUser); nav, forceLogin and group-required elements all read that one promise. - isLoggedIn is dual-mode (Promise + node-style callback), so the async and callback call styles both work from one shared top.ejs. - forceLogin no longer uses $.holdReady (removed in jQuery 4): it redirects to /login?redirect=<path>, and still enforces required groups. - logOut only clears the session; the caller decides where to go next. - post/put/delete are dual-mode Promise/callback, which also removes the undefined `callback2` reference that threw on a non-function callback. Dependencies: jquery ^4.0.0 and ejs ^3.1.10 in all three apps. jump-host specifics: - .group-required base rule added to styles.css (no gated nav items yet). - #spa-shell drops its inline margin-top; styles.css already sets it, and the shared shell adjusts it when a banner is shown. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
48 lines
1.4 KiB
JavaScript
48 lines
1.4 KiB
JavaScript
'use strict';
|
|
|
|
const express = require('express');
|
|
const compression = require('compression');
|
|
|
|
require('./models'); // wire model-redis + register models
|
|
|
|
const app = express();
|
|
|
|
app.set('view engine', 'ejs');
|
|
app.set('views', require('path').join(__dirname, 'views'));
|
|
|
|
// Per-app values for the shared UI shell (views/top.ejs + views/bottom.ejs).
|
|
// Set as an app local so every res.render has it, including routes that don't
|
|
// spread the render router's `values` object.
|
|
app.locals.ui = require('./utils/ui');
|
|
|
|
app.use(compression());
|
|
app.use(express.json());
|
|
app.use(express.urlencoded({extended: false}));
|
|
|
|
// Page shells + static assets + /health (mostly unauthenticated; the client
|
|
// gates itself on /api/user/me and redirects to /login).
|
|
app.use('/', require('./routes/render'));
|
|
|
|
// API — auth handled per-router inside (see routes/api.js).
|
|
app.use('/api', require('./routes/api'));
|
|
|
|
// 404
|
|
app.use((req, res, next) => {
|
|
const error = new Error('Not Found');
|
|
error.status = 404;
|
|
next(error);
|
|
});
|
|
|
|
// Error handler — JSON for API, redirect to login for pages on 401.
|
|
// eslint-disable-next-line no-unused-vars
|
|
app.use((err, req, res, next) => {
|
|
const status = err.status || 500;
|
|
if(status >= 500) console.error(err);
|
|
if(req.path.startsWith('/api/')){
|
|
return res.status(status).json({name: err.name || 'Error', message: err.message || 'Error'});
|
|
}
|
|
res.status(status).send(err.message || 'Error');
|
|
});
|
|
|
|
module.exports = app;
|