wmantly
4fb4e77007
- New GET /api/user/hosts (auth-only): all hosts for admins, group-filtered list for everyone else. - accessibleHosts() accepts a pre-resolved user.groups, so the web UI's OIDC session skips a redundant LDAP getGroups(dn) call. - Dashboard shows a "Hosts you can reach" / "All hosts" table. - @simpleworkjs/ldap 1.0.1 fixes addSshKey's ObjectClassViolationError on accounts predating the ldapPublicKey objectClass -- was aborting key injection (and the SSH connection) on affected accounts. - Bump to 1.5.0. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
31 lines
997 B
JavaScript
31 lines
997 B
JavaScript
'use strict';
|
|
|
|
// Minimal user endpoint the client framework needs: GET /api/user/me tells the
|
|
// browser who it is and whether it's an admin (drives login state + nav).
|
|
|
|
const router = require('express').Router();
|
|
const { isAdmin } = require('../middleware/auth');
|
|
const access = require('../utils/access');
|
|
|
|
router.get('/me', (req, res) => {
|
|
res.json({
|
|
username: req.user && req.user.username,
|
|
groups: req.groups || [],
|
|
isAdmin: isAdmin(req),
|
|
});
|
|
});
|
|
|
|
// The hosts this session can SSH to — every host for an admin, otherwise the
|
|
// same group-based resolution the SSH front door uses (accessibleHosts),
|
|
// fed the OIDC session's already-known groups instead of an LDAP lookup.
|
|
router.get('/hosts', async (req, res, next) => {
|
|
try {
|
|
const hosts = isAdmin(req)
|
|
? await access.allHosts()
|
|
: await access.accessibleHosts({ uid: req.user && req.user.username, groups: req.groups || [] });
|
|
res.json({ results: hosts });
|
|
} catch (err) { next(err); }
|
|
});
|
|
|
|
module.exports = router;
|