wmantly
aa3b3ed515
The web management UI was a bespoke minimal theme with LDAP-bind login.
Rebuild it to match the SSO Manager and Proxy — same stack, same look/feel,
same auth model. The SSH bridge, audit, metrics, and access logic are
unchanged; this is purely the web layer.
Frontend (mirrors proxy/sso):
- Express + EJS with the shared top.ejs/bottom.ejs shell, Bootstrap 5,
jQuery, jq-repeat, FontAwesome, Socket.IO, and the shared app-base.js /
val.js client framework (copied verbatim). Vendor libs served from
node_modules via /static-modules; app assets via /static.
- Dashboard / Sessions / Audit pages render in the common look/feel,
loading data through the authenticated /api/* endpoints.
Auth (mirrors proxy):
- OIDC against the SSO (utils/oidc.js + routes/auth.js + models/oidc_state)
plus a local anti-lockout admin (models/user_redis.js, bootstrapped from
auth.adminUsers[0] / auth.localAdminPass). AuthToken sessions carry the
group snapshot; middleware gates the data API on adminGroups or the local
admin. New config: oidc{} + auth.adminUsers/localAdminPass.
- /api/user/me drives the client login state; "Log in with SSO" hidden when
oidc.enabled is false.
Verified end to end: local admin login -> token -> /api/user/me isAdmin,
metrics/sessions/audit 200 with token / 401 without / 401 bad password;
static + page shells serve; 26 tests green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
65 lines
1.7 KiB
JavaScript
65 lines
1.7 KiB
JavaScript
'use strict';
|
|
|
|
const Table = require('.');
|
|
const UUID = function b(a){return a?(a^Math.random()*16>>a/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,b)};
|
|
|
|
|
|
class Token extends Table{
|
|
static _key = 'token';
|
|
static _keyMap = {
|
|
'created_by': {isRequired: true, type: 'string', min: 3, max: 500},
|
|
'created_on': {default: function(){return (new Date).getTime()}},
|
|
'updated_on': {default: function(){return (new Date).getTime()}, always: true},
|
|
'token': {default: UUID, type: 'string', min: 36, max: 36, isPrivate: true},
|
|
'is_valid': {default: true, type: 'boolean'},
|
|
}
|
|
|
|
constructor(...args){
|
|
super(...args);
|
|
}
|
|
|
|
async check(){
|
|
try{
|
|
return this.is_valid;
|
|
}catch(error){
|
|
return false
|
|
}
|
|
}
|
|
}
|
|
|
|
Token.register();
|
|
|
|
class AuthToken extends Token{
|
|
static _keyMap = {
|
|
...super._keyMap,
|
|
user: {model: 'User', rel: 'one', localKey: 'created_by'},
|
|
// Group memberships captured at login (OIDC `groups` claim or LDAP
|
|
// group membership), stored as a JSON string. Drives authorization for
|
|
// the life of the session without re-querying the IdP on every request.
|
|
groups: {default: '[]', isRequired: false, type: 'string'},
|
|
}
|
|
|
|
static async create(data){
|
|
data.created_by = data.username;
|
|
if(Array.isArray(data.groups)){
|
|
data.groups = JSON.stringify(data.groups);
|
|
}
|
|
return super.create(data)
|
|
|
|
}
|
|
|
|
// Parse the stored groups JSON back into an array, tolerating bad/missing
|
|
// data so authorization never crashes on a malformed token.
|
|
groupsArray(){
|
|
try{
|
|
let parsed = JSON.parse(this.groups);
|
|
return Array.isArray(parsed) ? parsed : [];
|
|
}catch(error){
|
|
return [];
|
|
}
|
|
}
|
|
}
|
|
AuthToken.register();
|
|
|
|
module.exports = {Token, AuthToken};
|