Release 1.3.0: adopt shared @simpleworkjs/* packages; fix LDAP filter injection

Rewire onto the shared @simpleworkjs/oidc-client, /ldap, and /app-stack
packages (deleting the byte-identical local forks of the same code), close the
LDAP filter-injection in User.get by routing the username through escapeFilter
(RFC 4515), align model-redis ^1.6.0 and ldapts ^8.1.8, and unify build_info to
{buildVersion, buildHash, buildYear}. package-lock regenerated from the npm
registry (no file:/link:), so npm ci is clean in docker builds.

Co-Authored-By: Claude <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,60 @@ correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.
 
 ## [Unreleased]
 
+## [1.3.0] - 2026-07-25
+
+### Added
+- Adopted the shared `@simpleworkjs/*` packages published under the simpleworkjs org, replacing this app's byte-identical forks of the same code so the theta42 apps share one codebase and API schema:
+  - `@simpleworkjs/oidc-client` — the OIDC client (session models, auth router, OIDC utils, safe-redirect, local-admin bootstrap). Deleted the local `utils/oidc.js`, `utils/safe_redirect.js`, `models/oidc_state.js`, `models/token.js`, `models/auth.js`, and `routes/auth.js`; `models/index.js` now wires the factory. The per-host SSO in `routes/host_auth.js` is unchanged but consumes the shared OIDC utils.
+  - `@simpleworkjs/ldap` — the ldapts client + RFC 4515/4514 escaping.
+  - `@simpleworkjs/app-stack` — unified `build_info` (`{buildVersion, buildHash, buildYear}`) and the `static-modules` mounting helper. `utils/build_info.js` and the static-modules loop in `routes/render.js` now use the shared helpers.
+
+### Security
+- **LDAP filter injection in `User.get`.** The user lookup built its search filter by interpolating `data.username` raw into `(&(objectClass=inetOrgPerson)(uid=<username>))`. A username containing `*`, `(`, `)`, `\`, or NUL could widen or alter the filter (e.g. `*` → match-all). The filter value is now passed through `escapeFilter` from `@simpleworkjs/ldap` (RFC 4515 escaping).
+
+### Changed
+- Dependency alignment: `model-redis` `^1.5` → `^1.6.0`, `ldapts` `^8.1.2` → `^8.1.8`. The four new `@simpleworkjs/*` deps resolve from the npm registry (`^1.0.0`); no `file:`/`link:` entries in the lockfile, so `npm ci` is clean in docker builds.
+- `build_info` export shape changed from `{commit, version}` to `{buildVersion, buildHash, buildYear}` (the shared shape used by all three apps). The `/health` endpoint and footer now report `buildVersion`/`buildHash`.
+
+## [1.2.2] - 2026-07-21
+
+### Fixed
+- Multi-target load balancing (added in 1.2.0) crashed every request to a load-balanced host: `ops/nginx_conf/targetinfo.lua` required a nonexistent `resty.balancer.round_robin` module. The `lua-resty-balancer` rock installed by the Dockerfile/`install.sh` doesn't provide that path — it provides `resty.roundrobin` (constructed as `roundrobin:new(nodes)`, not `:new()` + `:reinit(nodes)`). Fixed `targetinfo.lua` to use the real module and API; verified end-to-end that requests now round-robin across targets with no Lua errors.
+
+## [1.2.1] - 2026-07-21
+
+### Fixed
+- The bootstrap anti-lockout admin account was always created as `proxyadmin2` regardless of `conf.auth.adminUsers`, while `migrations/permission_bootstrap.js` grants the global-admin permission to `conf.auth.adminUsers[0]`. If an operator customized `adminUsers` away from the default, the bootstrapped account and the permissioned account were two different (non-matching) usernames, so the anti-lockout account ended up with no admin access. `models/user_redis.js` now derives the bootstrap username from `conf.auth.adminUsers[0]` (falling back to `proxyadmin2`), matching `permission_bootstrap.js`.
+- Corrected a `secrets.js.example` comment that claimed the bootstrap admin's password "defaults to the username itself" — it actually generates a random password printed to the container log on first boot.
+
+### Changed
+- Refreshed all README screenshots (hosts, per-host SSO auth, per-host basic auth) against the current UI, and added a new load-balancing screenshot for the multi-target feature.
+
+## [1.2.0] - 2026-07-21
+
+### Added
+- Multi-target load balancing: hosts can now specify additional backend targets (`IP:port`, one per line) alongside the primary target; the proxy distributes requests across all of them round-robin via `lua-resty-balancer`. Fixes #47.
+
+## [1.1.17] - 2026-07-20
+
+### Fixed
+- An existing single-label subdomain host (e.g. `sso.nl.wgnode.com`) could not be attached to a wildcard cert added later (e.g. `*.nl.wgnode.com`): `Host.lookUpWildcardParent()` only checked the wildcard-as-child position (the wildcard's own base domain) and missed the far more common wildcard-as-sibling case, so the edit form's "Parent Wildcard" option stayed permanently greyed out. It now checks both positions, and a regression test covers the sibling case.
+
+## [1.1.16] - 2026-07-18
+
+### Changed
+- Public-release packaging: removed `"private": true` from `nodejs/package.json`, corrected the repository URL to `https://github.com/theta42/proxy.git`, and fixed the MIT `LICENSE` copyright line.
+- Genericized committed defaults in `conf/base.js` and `conf/development.js`: LDAP now defaults to `ldap://localhost` with `dc=example,dc=com`, and OIDC endpoints default to `https://sso.example.com` instead of internal theta42 infrastructure.
+- The bootstrap `proxyadmin2` account now gets a random, one-time password when `auth.localAdminPass` is unset, instead of the well-known default `proxyadmin2`. The password is printed to the log on first creation and can be made deterministic by setting `auth.localAdminPass` in the secrets file.
+
+### Security
+- Sanitized rendered docs HTML via `xss` in `routes/docs.js` so malicious markdown cannot inject scripts or other dangerous markup into the in-app docs viewer.
+- The Unix socket JSON-RPC socket is now created with mode `660` instead of world-writable `777`.
+
+### Fixed
+- The global error handler no longer leaks `err.keys`, stack traces, or other internal details in JSON responses; only `name` and `message` are returned to clients.
+- `DEPLOYMENT.md` and `docs/docker.md` now correctly describe the `CONF_SECRETS` env-var mechanism instead of the old symlink behavior.
+
 ## [1.1.15] - 2026-07-18
 
 ### Changed
@@ -112,7 +166,9 @@ First tagged release. Establishes the `vX.Y.Z` tag convention that the in-app up
 - Standalone backup script (`ops/backup.sh`) for deployments not using theta-env's orchestrator — snapshots Redis and `./config`, with retention.
 - Admin-only in-app banner that checks GitHub releases every 24h and surfaces available updates.
 
-[Unreleased]: https://github.com/theta42/proxy/compare/v1.1.15...HEAD
+[Unreleased]: https://github.com/theta42/proxy/compare/v1.1.17...HEAD
+[1.1.17]: https://github.com/theta42/proxy/compare/v1.1.16...v1.1.17
+[1.1.16]: https://github.com/theta42/proxy/compare/v1.1.15...v1.1.16
 [1.1.15]: https://github.com/theta42/proxy/compare/v1.1.14...v1.1.15
 [1.1.14]: https://github.com/theta42/proxy/compare/v1.1.13...v1.1.14
 [1.1.13]: https://github.com/theta42/proxy/compare/v1.1.12...v1.1.13

DEPLOYMENT.md

@@ -75,11 +75,12 @@ $EDITOR config/proxy-secrets.js     # set oidc.clientId/clientSecret, ldap.bindP
 docker compose up -d --build
 ```
 
-`docker-entrypoint.sh` symlinks `/config/proxy-secrets.js` → `/app/conf/secrets.js`
+`docker-entrypoint.sh` sets `CONF_SECRETS=/config/proxy-secrets.js` so
-so `@simpleworkjs/conf` reads it. No `app_*` env is passed — `app_*` env would
+`@simpleworkjs/conf` reads it directly. No `app_*` env is passed — `app_*` env
-override the file (env beats secrets.js in `@simpleworkjs/conf`), so the file is
+would override the file (env beats secrets.js in `@simpleworkjs/conf`), so the
-kept authoritative. `RESOLVER` / `REAL_IP_FROM` / `NODE_ENV` / `NODE_PORT` are
+file is kept authoritative. `RESOLVER` / `REAL_IP_FROM` / `NODE_ENV` /
-OpenResty-runtime / process env, not `app_*` config, so they stay in the compose.
+`NODE_PORT` are OpenResty-runtime / process env, not `app_*` config, so they
+stay in the compose.
 
 > Running the unified `theta-env` stack? Its `setup.sh` generates
 > `./config/proxy-secrets.js` (+ `./config/sso-secrets.js`) for you and

Dockerfile

@@ -83,6 +83,7 @@ RUN apt-get update \
 # resty.limit.req is bundled with OpenResty, so no rock is needed for it.
 RUN luarocks install lua-resty-auto-ssl \
     && luarocks install luasocket \
+    && luarocks install lua-resty-balancer \
     && luarocks install lua-resty-ipmatcher
 
 # ── Node app ─────────────────────────────────────────────────────────────────

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) <year> <copyright holders>
+Copyright (c) 2026 theta42
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 

README.md

@@ -31,6 +31,10 @@ management once basic auth is enabled:
 
 [![Per-host basic auth](docs/images/host-auth-basic.png)](docs/images/host-auth-basic.png)
 
+Multiple backend targets per host, load balanced round-robin:
+
+[![Load balancing](docs/images/load-balancing.png)](docs/images/load-balancing.png)
+
 ## Why this over the alternatives
 
 Nginx Proxy Manager, Traefik, and Caddy are all good reverse proxies with
@@ -51,6 +55,7 @@ provider + LDAP directory you already run.
 - Multiple DNS provider integrations (Cloudflare, DigitalOcean, PorkBun, DuckDNS — DuckDNS is free)
 - Wildcard SSL certificate support with automatic renewal
 - Dynamic host routing with wildcard domain matching (*, **)
+- **Multi-target load balancing** — configure multiple backend targets per host with built-in round-robin load balancing
 - Web-based management interface
 - RESTful API for automation
 - **OIDC login** — the proxy is an OpenID Connect client of an external SSO

docs/concepts-hosts.md

@@ -68,6 +68,10 @@ host form whenever the name you're entering already has a matching
 wildcard available to reuse — including the wildcard's own bare base
 domain (e.g. `example.com` itself, not just `something.example.com`).
 
+## Load Balancing
+
+If you have multiple servers running the same application, you can load balance traffic across them. When editing a host, you can specify **Additional Targets** (one `IP:port` per line). The proxy will automatically distribute incoming requests across your primary target and all additional targets using a round-robin strategy, providing simple high availability and load distribution without extra configuration.
+
 ## Want more detail?
 
 This page skips the system-internals (Redis, OpenResty, the lookup service)

docs/docker.md

@@ -39,11 +39,11 @@ which deep-merges, in order:
 3. `conf/secrets.js` (gitignored)
 4. **`app_*` environment variables** — the highest-precedence layer
 
-The bundled `docker-compose.yml` mount `./config/proxy-secrets.js` at `/config`,
+The bundled `docker-compose.yml` mounts `./config/proxy-secrets.js` at `/config`,
-and `docker-entrypoint.sh` symlinks it into `/app/conf/secrets.js` so the app
+and `docker-entrypoint.sh` sets `CONF_SECRETS=/config/proxy-secrets.js` so the
-reads the OIDC + LDAP + auth wiring from the file. **No `app_*` env is passed** —
+app reads the OIDC + LDAP + auth wiring from the file. **No `app_*` env is
-`app_*` env beats `secrets.js`, so the file is authoritative only if the matching
+passed** — `app_*` env beats `secrets.js`, so the file is authoritative only if
-`app_*` env is absent. See `secrets.js.example` for the shape.
+the matching `app_*` env is absent. See `secrets.js.example` for the shape.
 
 Any env var starting with `app_` overrides the merged config; the rest of the
 name splits on **double-underscore** (`__`) into a nested path. Values are

docs/index.md

@@ -50,6 +50,7 @@ LDAP directory you already run.
 - Automated HTTPS via Let's Encrypt — HTTP-01 and DNS-01 (wildcard) challenges
 - Multiple DNS providers (Cloudflare, DigitalOcean, PorkBun, DuckDNS — free)
 - Dynamic host routing with wildcard domain matching (`*`, `**`)
+- **Multi-target load balancing** — configure multiple backend targets per host with built-in round-robin load balancing
 - **OIDC login** and **direct LDAP lookups**, independently of each other
 - Per-host **basic auth** as an alternative to SSO (mutually exclusive, so
   it's never ambiguous which one gated a request)

nodejs/app.js

@@ -100,15 +100,21 @@ app.use(async function(req, res, next) {
 
 // Error handler. This is where `next()` will go on error
 app.use(async function(err, req, res, next) {
-  try{  
+  try{
-    console.error(err.status || res.status, err.name, req.method, req.url);
+    const status = err.status || 500;
+    console.error(status, err.name, req.method, req.url);
     console.error(err.message);
-    console.error(err.stack);
+    if (err.stack) console.error(err.stack);
     console.error('=========================================');
 
-    res.status(err.status || 500);
+    res.status(status);
-    res.json({name: err.name, message: err.message, keys: err.keys});
+    // Only expose safe, non-internal fields to the client.
+    const body = { name: err.name, message: err.message };
+    res.json(body);
   }catch(error){
-    console.log('error in the catch all error fn....', error);
+    console.error('error in the catch-all error handler', error);
+    if (!res.headersSent) {
+      res.status(500).json({ name: 'Error', message: 'Internal server error' });
+    }
   }
 });

nodejs/conf/base.js

@@ -6,10 +6,10 @@ module.exports = {
 	logo: "/static/img/theta42.svg", // shown in the nav; point at your own file under public/ (or an absolute URL) to white-label
 	userModel: 'redis', // pam, redis, ldap
 	ldap: {
-		url: 'ldap://192.168.1.55:389',
+		url: 'ldap://localhost',
-		bindDN: 'cn=ldapclient service,ou=people,dc=theta42,dc=com',
+		bindDN: 'cn=ldapclient service,ou=people,dc=example,dc=com',
 		bindPassword: '__IN SRECREST FILE__',
-		searchBase: 'ou=people,dc=theta42,dc=com',
+		searchBase: 'ou=people,dc=example,dc=com',
 		userFilter: '(objectClass=inetOrgPerson)',
 		userNameAttribute: 'uid'
 	},
@@ -29,11 +29,11 @@ module.exports = {
 	// redirectUri MUST be registered on the SSO client and match exactly.
 	oidc: {
 		enabled: true,
-		issuer: 'https://sso.theta42.com',
+		issuer: 'https://sso.example.com',
-		authorizationEndpoint: 'https://sso.theta42.com/oauth/authorize',
+		authorizationEndpoint: 'https://sso.example.com/oauth/authorize',
-		tokenEndpoint: 'https://sso.theta42.com/oauth/token',
+		tokenEndpoint: 'https://sso.example.com/oauth/token',
-		userinfoEndpoint: 'https://sso.theta42.com/oauth/userinfo',
+		userinfoEndpoint: 'https://sso.example.com/oauth/userinfo',
-		endSessionEndpoint: 'https://sso.theta42.com/oauth/logout',
+		endSessionEndpoint: 'https://sso.example.com/oauth/logout',
 		clientId: '__SET_ME__',
 		// Where the SSO sends the user back. Must be an absolute URL reachable
 		// by the browser and registered on the SSO client.

nodejs/conf/development.js

@@ -4,10 +4,10 @@
 module.exports = {
 	userModel: 'redis', // pam, redis, ldap
 	ldap: {
-		url: 'ldap://192.168.1.55:389',
+		url: 'ldap://localhost',
-		bindDN: 'cn=ldapclient service,ou=people,dc=theta42,dc=com',
+		bindDN: 'cn=ldapclient service,ou=people,dc=example,dc=com',
 		bindPassword: '__IN SRECREST FILE__',
-		searchBase: 'ou=people,dc=theta42,dc=com',
+		searchBase: 'ou=people,dc=example,dc=com',
 		userFilter: '(objectClass=inetOrgPerson)',
 		userNameAttribute: 'uid'
 	},

nodejs/middleware/auth.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const {Auth} = require('../models/auth');
+const {Auth} = require('../models');
 
 async function auth(req, res, next){
 	try{

nodejs/models/auth.js

@@ -1,136 +0,0 @@
-'use strict';
-
-const Table = require('../models');
-const {User, AuthToken} = Table.models;
-const {ApiToken} = require('./api_token');
-
-/**
- * Auth Model
- *
- * Handles authentication operations for the application.
- * Manages user login, token validation, and logout processes.
- *
- * Dependencies:
- * - User model: Validates user credentials
- * - AuthToken model: Creates and manages authentication tokens
- *
- * All methods throw standardized login errors on failure to avoid
- * leaking information about whether usernames exist or tokens are valid.
- */
-class Auth{
-	/**
-	 * Standardized error responses for authentication failures.
-	 * Returns generic "Invalid Credentials" message for security.
-	 */
-	static errors = {
-		login: function(){
-			let error = new Error('LoginFailed');
-			error.name = 'LoginFailed';
-			error.message = `Invalid Credentials, login failed.`;
-			error.status = 401;
-
-			return error;
-		}
-	}
-
-	/**
-	 * Authenticate user and create session token.
-	 *
-	 * @param {Object} data - Login credentials {username, password}
-	 * @returns {Object} {user, token} - User object and auth token
-	 * @throws {Error} Generic login error on any failure
-	 *
-	 * Flow:
-	 * 1. Validate credentials via User.login()
-	 * 2. Create new AuthToken for the user
-	 * 3. Return both user data and token
-	 */
-	static async login(data){
-		try{
-			let user = await User.login(data);
-			// Backends may attach group membership to the user (LDAP); default
-			// to none for local/redis users.
-			let groups = Array.isArray(user.groups) ? user.groups : [];
-			let token = await AuthToken.create({username: user.username, groups});
-
-			return {user, token}
-		}catch(error){
-			console.log('login error', error);
-			throw this.errors.login();
-		}
-	}
-
-	/**
-	 * Establish a session for an OIDC-authenticated identity: JIT-provision the
-	 * local user (redis-backed) and mint an AuthToken carrying the SSO groups.
-	 *
-	 * @param {Object} identity - {username, groups} from utils/oidc claims
-	 * @returns {Object} {user, token}
-	 */
-	static async oidcSession(identity){
-		let user = typeof User.upsertOidc === 'function'
-			? await User.upsertOidc(identity)
-			: await User.get(identity.username);
-		let token = await AuthToken.create({
-			username: user.username,
-			groups: identity.groups || [],
-		});
-
-		return {user, token};
-	}
-
-	/**
-	 * Validate an authentication token.
-	 *
-	 * @param {string} token - Token string to validate
-	 * @returns {Object} Token object if valid
-	 * @throws {Error} Generic login error if token invalid or expired
-	 *
-	 * Checks:
-	 * 1. Token exists in database
-	 * 2. Token has not expired (via token.check())
-	 */
-	static async checkToken(token){
-		try{
-			token = await AuthToken.get(token);
-			if(token && token.check()) return token;
-
-			throw this.errors.login();
-		}catch(error){
-			console.log('check error', error);
-			throw this.errors.login();
-		}
-	}
-
-	/**
-	 * Validate an `Authorization: Bearer prx_<id>_<secret>` API token.
-	 *
-	 * Returns the authenticated ApiToken record (with created_by + the
-	 * mint-time groups snapshot); middleware/auth.js wraps it into the
-	 * req.token shape the authz layer expects. Every failure collapses to the
-	 * same generic login 401 — no leak of existence / wrong secret / expired.
-	 */
-	static async checkApiToken(raw){
-		try{
-			return await ApiToken.authenticate(raw);
-		}catch(error){
-			console.log('api-token check error', error);
-			throw this.errors.login();
-		}
-	}
-
-	/**
-	 * Destroy an authentication token (logout).
-	 *
-	 * @param {string} data - Token string to destroy
-	 * @returns {void}
-	 *
-	 * Removes token from database, invalidating the session.
-	 */
-	static async logout(data){
-		let token = await AuthToken.get(data);
-		await token.destroy();
-	}
-}
-
-module.exports = {Auth};

nodejs/models/host.js

@@ -28,6 +28,7 @@ class Host extends Table{
 		'host': {isRequired: true, type: 'string', min: 1, max: 500},
 		'ip': {isRequired: true, type: 'string', min: 3, max: 500},
 		'targetPort': {isRequired: true, type: 'number', min:0, max:65535},
+		'targets': {default: function(){return []}, isRequired: false, type: 'object'},
 		'forcessl': {isRequired: false, default: true, type: 'boolean'},
 		'targetssl': {isRequired: false, default: false, type: 'boolean'},
 
@@ -518,24 +519,38 @@ class Host extends Table{
 		if(parent && parent['*'] && parent['*']['#record']) return parent['*']['#record'];
 	}
 
-	// Find the wildcard covering @host as its own base domain (e.g.
+	// Find the wildcard that could cover @host, regardless of whether @host is
-	// "*.cool.mysite.com" for host="cool.mysite.com"), regardless of whether
+	// already registered as its own host. Unlike lookUp(), which walks to and
-	// @host is already registered as its own host. Unlike lookUp(), which
+	// returns @host's own exact-match leaf when one exists, this keeps looking
-	// walks to and returns @host's own exact-match leaf when one exists, this
+	// for a sibling/child "*" slot, so it still finds the parent wildcard even
-	// walks to that exact position and looks one level deeper at its "*"
+	// when @host already has its own (non-wildcard) record. Used when attaching
-	// child -- the sibling wildcard slot -- so it still finds the parent
+	// an already-created host to a wildcard after the fact (see update() below);
-	// wildcard even when @host already has its own (non-wildcard) record.
+	// Host.create()'s own wildcardChild handling can keep using plain lookUp()
-	// Used when attaching an already-created host to a wildcard after the
+	// since a host being newly created hasn't claimed its own leaf yet.
-	// fact (see update() below); Host.create()'s own wildcardChild handling
+	//
-	// can keep using plain lookUp() since a host being newly created hasn't
+	// Two tree positions qualify, and we must check BOTH:
-	// claimed its own leaf yet.
+	//   1. Child "*" of @host's own node -- @host is the wildcard's base domain
+	//      (e.g. "*.cool.mysite.com" covers host="cool.mysite.com").
+	//   2. Sibling "*" one level up -- @host is a single-label subdomain of the
+	//      wildcard (e.g. "*.nl.wgnode.com" covers host="sso.nl.wgnode.com").
+	// Case 2 is the common one and was previously missed: the walk consumed the
+	// leftmost label ("sso") and only inspected that leaf's "*" child, so an
+	// already-existing sibling subdomain could never be attached to its wildcard.
 	static lookUpWildcardParent(host){
 		let place = this.lookUpObj;
+		let parent = undefined;
 		for(let fragment of host.split('.').reverse()){
-			if(!place[fragment]) return undefined;
+			// @host may have no leaf of its own (brand-new subdomain); that case
+			// is already handled by plain lookUp()'s wildcard fallback in the
+			// caller, so just stop -- we've still tracked `parent` for case 2.
+			if(!place[fragment]){ place = undefined; break; }
+			parent = place;
 			place = place[fragment];
 		}
-		if(place['*'] && place['*']['#record']) return place['*']['#record'];
+		// Case 1: wildcard is a child of @host's own node.
+		if(place && place['*'] && place['*']['#record']) return place['*']['#record'];
+		// Case 2: wildcard is a sibling of @host's leftmost label.
+		if(parent && parent['*'] && parent['*']['#record']) return parent['*']['#record'];
 	}
 
 	static async lookUpReady(){

nodejs/models/index.js

@@ -1,18 +1,37 @@
 'use strict';
 const conf = require('@simpleworkjs/conf');
 const {setUpTable} = require('model-redis');
+const {createOidcClient, bootstrapLocalAdmin} = require('@simpleworkjs/oidc-client');
 
 const Table = setUpTable(conf.redis);
 
 module.exports = Table;
 
+// App-local models. User + ApiToken register before the OIDC client factory
+// below: Auth binds User, and checkApiToken wraps ApiToken.authenticate.
+require('./user');                      // User (redis-backed local + OIDC JIT)
+const {ApiToken} = require('./api_token'); // ApiToken (Bearer PATs)
 require('./dns_provider');
 require('./dynamic_record');
 require('./host');
-require('./token');
-require('./user');
 require('./local_group');
 require('./permission');
-require('./oidc_state');
 require('./sso_session');
-require('./api_token');
+
+// Shared OIDC client (authorization-code + PKCE): session models (Token,
+// AuthToken, OidcState), the Auth service, and the /login /logout /oidc/start
+// /oidc/callback router — all created on this app's Table/redis. PAT validation
+// is wired in (proxy accepts Bearer prx_<id>_<secret>); the package collapses
+// every checkApiToken failure to a generic 401.
+const oidcClient = createOidcClient({
+	Table,
+	checkApiToken: (raw) => ApiToken.authenticate(raw),
+});
+module.exports.Token = oidcClient.Token;
+module.exports.AuthToken = oidcClient.AuthToken;
+module.exports.OidcState = oidcClient.OidcState;
+module.exports.Auth = oidcClient.Auth;
+module.exports.authRouter = oidcClient.router;
+
+// Idempotent anti-lockout local admin (was the IIFE in user_redis.js).
+bootstrapLocalAdmin(Table.models.User, {defaultName: 'proxyadmin2'});

nodejs/models/oidc_state.js

@@ -1,31 +0,0 @@
-'use strict';
-
-const Table = require('.');
-
-/**
- * OidcState
- *
- * Short-lived store for an in-flight OpenID Connect authorization request.
- * Keyed by the random `state` value; holds the PKCE `code_verifier` and the
- * post-login redirect target until the SSO calls us back.
- *
- * The record auto-expires via model-redis per-key TTL (static _ttl), so an
- * abandoned login attempt leaves nothing behind and there is no cleanup job.
- */
-class OidcState extends Table{
-	static _key = 'state';
-
-	// Auth round-trips are quick; 5 minutes is plenty and bounds replay.
-	static _ttl = 300;
-
-	static _keyMap = {
-		'created_on': {default: function(){return (new Date).getTime()}},
-		'state': {isRequired: true, type: 'string', min: 8, max: 500},
-		'codeVerifier': {isRequired: true, type: 'string', min: 8, max: 500},
-		'redirect': {default: '/', isRequired: false, type: 'string'},
-	}
-}
-
-OidcState.register();
-
-module.exports = {OidcState};

nodejs/models/token.js

@@ -1,64 +0,0 @@
-'use strict';
-
-const Table = require('.');
-const UUID = function b(a){return a?(a^Math.random()*16>>a/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,b)};
-
-
-class Token extends Table{
-	static _key = 'token';
-	static _keyMap = {
-		'created_by': {isRequired: true, type: 'string', min: 3, max: 500},
-		'created_on': {default: function(){return (new Date).getTime()}},
-		'updated_on': {default: function(){return (new Date).getTime()}, always: true},
-		'token': {default: UUID, type: 'string', min: 36, max: 36, isPrivate: true},
-		'is_valid': {default: true, type: 'boolean'},	
-	}
-
-	constructor(...args){
-		super(...args);
-	}
-
-	async check(){
-		try{
-			return this.is_valid;
-		}catch(error){
-			return false
-		}
-	}
-}
-
-Token.register();
-
-class AuthToken extends Token{
-	static _keyMap = {
-		...super._keyMap,
-		user: {model: 'User', rel: 'one', localKey: 'created_by'},
-		// Group memberships captured at login (OIDC `groups` claim or LDAP
-		// group membership), stored as a JSON string. Drives authorization for
-		// the life of the session without re-querying the IdP on every request.
-		groups: {default: '[]', isRequired: false, type: 'string'},
-	}
-
-	static async create(data){
-		data.created_by = data.username;
-		if(Array.isArray(data.groups)){
-			data.groups = JSON.stringify(data.groups);
-		}
-		return super.create(data)
-
-	}
-
-	// Parse the stored groups JSON back into an array, tolerating bad/missing
-	// data so authorization never crashes on a malformed token.
-	groupsArray(){
-		try{
-			let parsed = JSON.parse(this.groups);
-			return Array.isArray(parsed) ? parsed : [];
-		}catch(error){
-			return [];
-		}
-	}
-}
-AuthToken.register();
-
-module.exports = {Token, AuthToken};

nodejs/models/user_ldap.js

@@ -1,8 +1,8 @@
 'use strict';
 
 const { Client, Attribute, Change } = require('ldapts');
-const {Token} = require('./token');
 const conf = require('@simpleworkjs/conf').ldap;
+const { escapeFilter } = require('@simpleworkjs/ldap');
 
 // tlsOptions is optional and forwarded to ldapts so the proxy can bind to
 // ldaps:// with a self-signed or internal-CA cert. Set via conf/secrets.js or
@@ -107,7 +107,9 @@ User.get = async function(data){
 		
 		await client.bind(conf.bindDN, conf.bindPassword);
 
-		let filter = `(&${conf.userFilter}(${conf.userNameAttribute}=${data.username}))`;
+		// Escape the interpolated username (RFC 4515) — previously raw, which
+		// let `*`/`(`/`)`/`\`/NUL in a username break or broaden the filter.
+		let filter = `(&${conf.userFilter}(${conf.userNameAttribute}=${escapeFilter(data.username)}))`;
 
 		const res = await client.search(conf.searchBase, {
 			scope: 'sub',

nodejs/models/user_pam.js

@@ -2,7 +2,6 @@
 
 const linuxUser = require('linux-sys-user').promise();
 const objValidate = require('../utils/object_validate');
-const {Token} = require('./token');
 const {promisify} = require('util');
 const pam = require('authenticate-pam');
 const authenticate = promisify(pam.authenticate);

nodejs/models/user_redis.js

@@ -3,7 +3,6 @@
 const Table = require('.');
 const bcrypt = require('bcrypt');
 const crypto = require('crypto');
-const conf = require('@simpleworkjs/conf');
 const saltRounds = 10;
 
 class User extends Table{
@@ -86,26 +85,6 @@ class User extends Table{
 
 User.register();
 
-(async function(){
+// Anti-lockout local-admin bootstrap moved to @simpleworkjs/oidc-client
-	var defaultUser = 'proxyadmin2'
+// (bootstrapLocalAdmin); invoked once from models/index.js after User is
-	// Optional: an orchestrator (e.g. theta-env's setup.sh) can set
+// registered. See the package lib/bootstrap.js for the original logic.
-	// auth.localAdminPass in proxy-secrets.js to a generated password so this
-	// bootstrap account isn't left at the well-known default (username ==
-	// password == "proxyadmin2"). Only used on first creation -- once the
-	// account exists this is never read again, so it's safe to leave set.
-	var defaultPass = (conf.auth && conf.auth.localAdminPass) || defaultUser;
-	try{
-		let user = await User.get(defaultUser);
-	}catch(error){
-		try{
-			let user = await User.create({
-				username:defaultUser,
-				password: defaultPass,
-				created_by: defaultUser
-			});
-			console.log(defaultUser, 'created', user);
-		}catch(error){
-			console.error(error)
-		}
-	}
-})();

nodejs/package-lock.json

@@ -1,17 +1,20 @@
 {
   "name": "proxy-api",
-  "version": "1.1.15",
+  "version": "1.2.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "proxy-api",
-      "version": "1.1.15",
+      "version": "1.2.2",
       "license": "MIT",
       "dependencies": {
         "@fortawesome/fontawesome-free": "^7.3.0",
         "@popperjs/core": "^2.11.8",
-        "@simpleworkjs/conf": "^1.1.0",
+        "@simpleworkjs/app-stack": "^1.0.0",
+        "@simpleworkjs/conf": "^1.2.0",
+        "@simpleworkjs/ldap": "^1.0.0",
+        "@simpleworkjs/oidc-client": "^1.0.0",
         "acme-client": "^5.4.0",
         "axios": "^1.13.5",
         "bcrypt": "^6.0.0",
@@ -21,18 +24,19 @@
         "express": "^5.2.1",
         "express-rate-limit": "^8.5.2",
         "extend": "^3.0.2",
-        "jq-repeat": "^2.1.0",
+        "jq-repeat": "^2.2.0",
         "jquery": "^4.0.0",
         "ldapts": "^8.1.8",
         "linux-sys-user": "^1.2.0",
         "marked": "^9.1.6",
-        "model-redis": "^1.5.0",
+        "model-redis": "^1.6.0",
         "moment": "^2.30.1",
         "mustache": "^4.2.0",
         "p2psub": "^0.2.0",
         "redis": "^6.1.0",
         "socket.io": "^4.8.3",
-        "tld-extract": "^2.1.0"
+        "tld-extract": "^2.1.0",
+        "xss": "^1.0.15"
       },
       "devDependencies": {
         "nodemon": "^3.1.11"
@@ -280,6 +284,18 @@
         "@redis/client": "^6.1.0"
       }
     },
+    "node_modules/@simpleworkjs/app-stack": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@simpleworkjs/app-stack/-/app-stack-1.0.0.tgz",
+      "integrity": "sha512-Hg/mouA87WruKeZqhqtJgAaLabjHY8Z9POO6U+DB7sGGDhy1jgZXT31hyxLUDV+InByOPhz48NIkGiWNwoesXQ==",
+      "license": "MIT",
+      "dependencies": {
+        "express": "^5.2.1"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@simpleworkjs/conf": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/@simpleworkjs/conf/-/conf-1.2.0.tgz",
@@ -292,6 +308,32 @@
         "node": ">=16.0.0"
       }
     },
+    "node_modules/@simpleworkjs/ldap": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@simpleworkjs/ldap/-/ldap-1.0.0.tgz",
+      "integrity": "sha512-saDmwk+KJ6kIWj9/MF37d+BM9KQisy6DsI9umyt1FWNyx6+wnEEat/1RUTwXKBd4IKJK+zPT5lC/B6gfa2CuAA==",
+      "license": "MIT",
+      "dependencies": {
+        "ldapts": "^8.1.8"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@simpleworkjs/oidc-client": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@simpleworkjs/oidc-client/-/oidc-client-1.0.0.tgz",
+      "integrity": "sha512-AzxIaE32p4yKDlp0mWvZp1wmXi8tMFckcPwMiQyZrDgEC0IybGhbjppPa+vNGx1AoVLp64vRL/zR3yXb/19NPg==",
+      "license": "MIT",
+      "dependencies": {
+        "@simpleworkjs/conf": "^1.2.0",
+        "express": "^5.2.1",
+        "express-rate-limit": "^8.5.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@socket.io/component-emitter": {
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/@socket.io/component-emitter/-/component-emitter-3.1.2.tgz",
@@ -611,6 +653,12 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/commander": {
+      "version": "2.20.3",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
+      "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
+      "license": "MIT"
+    },
     "node_modules/compressible": {
       "version": "2.0.18",
       "resolved": "https://registry.npmjs.org/compressible/-/compressible-2.0.18.tgz",
@@ -722,6 +770,12 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/cssfilter": {
+      "version": "0.0.10",
+      "resolved": "https://registry.npmjs.org/cssfilter/-/cssfilter-0.0.10.tgz",
+      "integrity": "sha512-FAaLDaplstoRsDR8XGYH51znUN0UY7nMc6Z9/fvE8EXGwvJE9hu7W2vHwx1+bd6gCYnln9nLbzxFTrcO9YQDZw==",
+      "license": "MIT"
+    },
     "node_modules/debug": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
@@ -1495,9 +1549,9 @@
       }
     },
     "node_modules/model-redis": {
-      "version": "1.5.0",
+      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/model-redis/-/model-redis-1.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/model-redis/-/model-redis-1.6.0.tgz",
-      "integrity": "sha512-eVXQQN+k3cR5aJBvPQurgr8WXYpAvVoLu6ydMWenSOJZBDVcHqeNqUCp8n5lYrxv6iZ8PlF0WQzZFmbJ1zP6/A==",
+      "integrity": "sha512-QinykZ0H9vhyj0qY9NnNd1m1YcBXBXuc0viENJuEyTwplhOWT0cpjpGxObqoD1ysb8AJkrBkJB9tAf4EZbISWA==",
       "license": "MIT",
       "dependencies": {
         "redis": "^6.1.0"
@@ -2251,6 +2305,22 @@
           "optional": true
         }
       }
+    },
+    "node_modules/xss": {
+      "version": "1.0.15",
+      "resolved": "https://registry.npmjs.org/xss/-/xss-1.0.15.tgz",
+      "integrity": "sha512-FVdlVVC67WOIPvfOwhoMETV72f6GbW7aOabBC3WxN/oUdoEMDyLz4OgRv5/gck2ZeNqEQu+Tb0kloovXOfpYVg==",
+      "license": "MIT",
+      "dependencies": {
+        "commander": "^2.20.3",
+        "cssfilter": "0.0.10"
+      },
+      "bin": {
+        "xss": "bin/xss"
+      },
+      "engines": {
+        "node": ">= 0.10.0"
+      }
     }
   }
 }

nodejs/package.json

@@ -1,7 +1,6 @@
 {
   "name": "proxy-api",
-  "version": "1.1.15",
+  "version": "1.3.0",
-  "private": true,
   "author": [
     {
       "name": "William Mantly",
@@ -23,6 +22,9 @@
     "@fortawesome/fontawesome-free": "^7.3.0",
     "@popperjs/core": "^2.11.8",
     "@simpleworkjs/conf": "^1.2.0",
+    "@simpleworkjs/app-stack": "^1.0.0",
+    "@simpleworkjs/ldap": "^1.0.0",
+    "@simpleworkjs/oidc-client": "^1.0.0",
     "acme-client": "^5.4.0",
     "axios": "^1.13.5",
     "bcrypt": "^6.0.0",
@@ -37,18 +39,19 @@
     "ldapts": "^8.1.8",
     "linux-sys-user": "^1.2.0",
     "marked": "^9.1.6",
-    "model-redis": "^1.5.0",
+    "model-redis": "^1.6.0",
     "moment": "^2.30.1",
     "mustache": "^4.2.0",
     "p2psub": "^0.2.0",
     "redis": "^6.1.0",
     "socket.io": "^4.8.3",
-    "tld-extract": "^2.1.0"
+    "tld-extract": "^2.1.0",
+    "xss": "^1.0.15"
   },
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://git.theta42.com/wmantly/proxy.git"
+    "url": "https://github.com/theta42/proxy.git"
   },
   "devDependencies": {
     "nodemon": "^3.1.11"

nodejs/routes/api.js

@@ -6,7 +6,7 @@ const middleware = require('../middleware/auth');
 const authz = require('../middleware/authz');
 
 // API routes for authentication.
-router.use('/auth',  require('./auth'));
+router.use('/auth',  require('../models').authRouter);
 
 // API routes for working with users. All endpoints need to be have valid user.
 // User management is admin-only; the router allows self-service exceptions

nodejs/routes/auth.js

@@ -1,111 +0,0 @@
-'use strict';
-
-const router = require('express').Router();
-const { rateLimit } = require('express-rate-limit');
-const conf = require('@simpleworkjs/conf');
-const { Auth } = require('../models/auth');
-const { OidcState } = require('../models/oidc_state');
-const oidc = require('../utils/oidc');
-const { safeInternalPath } = require('../utils/safe_redirect');
-
-// Throttle unauthenticated auth endpoints (credential login + the OIDC
-// handshake) to blunt brute-force / callback abuse. Keyed per IP.
-const authLimiter = rateLimit({
-	windowMs: 15 * 60 * 1000,   // 15 minutes
-	max: 60,                    // 60 attempts per IP per window
-	standardHeaders: true,
-	legacyHeaders: false,
-	message: {name: 'TooManyRequests', message: 'Too many attempts, please try again later.'},
-});
-
-
-router.post('/login', authLimiter, async function(req, res, next){
-	try{
-		let auth = await Auth.login(req.body);
-		return res.json({
-			login: true,
-			token: auth.token.token,
-			message:`${req.body.username} logged in!`,
-		});
-	}catch(error){
-		next(error);
-	}
-});
-
-router.all('/logout', async function(req, res, next){
-	try{
-		if(req.user){
-			await req.user.logout();
-		}
-
-		res.json({message: 'Bye'})
-	}catch(error){
-		next(error);
-	}
-});
-
-/**
- * OIDC login start: create a PKCE + state challenge, persist it (auto-expiring
- * via OidcState TTL), and redirect the browser to the SSO authorize endpoint.
- */
-router.get('/oidc/start', authLimiter, async function(req, res, next){
-	try{
-		if(!conf.oidc || !conf.oidc.enabled){
-			let error = new Error('OidcDisabled');
-			error.status = 404;
-			error.message = 'OIDC login is not enabled.';
-			throw error;
-		}
-
-		let {state, codeVerifier, codeChallenge} = oidc.createAuthRequest();
-		await OidcState.create({
-			state,
-			codeVerifier,
-			// Sanitize now so a hostile ?redirect= can't be stored and later
-			// reflected into the login page's navigation.
-			redirect: safeInternalPath(req.query.redirect || '/'),
-		});
-
-		return res.redirect(oidc.buildAuthUrl(state, codeChallenge));
-	}catch(error){
-		next(error);
-	}
-});
-
-/**
- * OIDC callback: validate state (consuming the one-time record), exchange the
- * code for tokens, read identity from userinfo, establish a session, and hand
- * the app token back to the browser via a URL fragment for the login page to
- * store in localStorage.
- */
-router.get('/oidc/callback', authLimiter, async function(req, res, next){
-	try{
-		let {code, state} = req.query;
-		if(!code || !state){
-			let error = new Error('OidcCallbackInvalid');
-			error.status = 400;
-			error.message = 'Missing code or state.';
-			throw error;
-		}
-
-		// get() throws if the state is unknown or has expired — this both binds
-		// the callback to our request and bounds replay.
-		let saved = await OidcState.get(state);
-		await saved.remove();
-
-		let tokens = await oidc.exchangeCode(code, saved.codeVerifier);
-		let claims = await oidc.fetchUserInfo(tokens.access_token);
-		let identity = oidc.claimsToIdentity(claims);
-
-		let {token} = await Auth.oidcSession(identity);
-
-		let redirect = safeInternalPath(saved.redirect || '/');
-		return res.redirect(
-			`/login#token=${encodeURIComponent(token.token)}&redirect=${encodeURIComponent(redirect)}`
-		);
-	}catch(error){
-		next(error);
-	}
-});
-
-module.exports = router;

nodejs/routes/docs.js

@@ -5,6 +5,7 @@ const path = require('path');
 const router = require('express').Router();
 const {rateLimit} = require('express-rate-limit');
 const {marked} = require('marked');
+const xss = require('xss');
 const conf = require('@simpleworkjs/conf');
 const buildInfo = require('../utils/build_info');
 
@@ -140,7 +141,7 @@ router.get('/:slug', function(req, res, next) {
 			docs: docList,
 			currentSlug: req.params.slug,
 			docTitle: doc.title,
-			docHtml: fixDocLinks(fixImagePaths(marked(content))),
+			docHtml: xss(fixDocLinks(fixImagePaths(marked(content)))),
 		});
 	} catch (error) {
 		next(error);

nodejs/routes/host_auth.js

@@ -3,7 +3,8 @@
 /**
  * Per-host SSO endpoints (#57), served under /__proxy_auth on EVERY proxied host
  * (nginx routes that path here; see ops/nginx_conf/proxy.conf). These run the
- * OIDC authorization-code flow (reusing utils/oidc.js and conf.oidc) and, on a
+ * OIDC authorization-code flow (reusing @simpleworkjs/oidc-client's pure oidc
+ * utils and conf.oidc) and, on a
  * successful + authorized login, mint a Redis-backed SsoSession and set the
  * `__proxy_sso` cookie for the host. OpenResty then gates the host on that
  * session (ops/nginx_conf/hostfeatures.lua).
@@ -15,7 +16,7 @@
 
 const router = require('express').Router();
 const conf = require('@simpleworkjs/conf');
-const oidc = require('../utils/oidc');
+const {oidc} = require('@simpleworkjs/oidc-client');
 const {Host} = require('../models').models;
 const {HostSsoState, SsoSession} = require('../models/sso_session');
 const {identityAllowed} = require('../utils/host_sso');

nodejs/routes/render.js

@@ -5,6 +5,7 @@ const express = require('express');
 const router = require('express').Router();
 const conf = require('@simpleworkjs/conf');
 const buildInfo = require('../utils/build_info');
+const { mountStaticModules } = require('@simpleworkjs/app-stack');
 
 const values ={
   title: conf.environment !== 'production' ? `dev` : '',
@@ -15,24 +16,16 @@ const values ={
 }
 
 // List of front end node modules to be served
-const frontEndModules = ['bootstrap', 'mustache', 'jquery', '@fortawesome',
-  'moment', '@popper', 'jq-repeat',
-];
-
-// Server front end modules
-// https://stackoverflow.com/a/55700773/3140931
 // Vendor libraries only change when package versions are bumped (a rebuild),
 // so they're safe to cache aggressively; ETag/Last-Modified (on by default)
-// still cover that rare case with a cheap 304 instead of a stale asset.
+// still cover that rare case with a cheap 304 instead of a stale asset. The
-frontEndModules.forEach(dep => {
+// app's own JS/CSS/img from public/ gets a shorter maxAge since it changes on
-  router.use(`/static-modules/${dep}`, express.static(path.join(__dirname, `../node_modules/${dep}`), {maxAge: '7d'}))
+// every deploy and isn't cache-busted/fingerprinted.
+mountStaticModules(router, {
+  root: path.join(__dirname, '..'),
+  deps: ['bootstrap', 'mustache', 'jquery', '@fortawesome', 'moment', '@popper', 'jq-repeat'],
 });
 
-// Have express server static content( images, CSS, browser JS) from the public
-// local folder. Shorter maxAge than /static-modules since this is the app's
-// own JS/CSS, which changes on every deploy and isn't cache-busted/fingerprinted.
-router.use('/static', express.static(path.join(__dirname, '../public'), {maxAge: '1h'}))
-
 router.get('/', (req, res) => {
   res.redirect(301, '/hosts');
 });

nodejs/test/unit/host_lookup.test.js

@@ -185,6 +185,35 @@ describe('Host wildcard base-domain lookup', () => {
 		await populateTree(Host, ['*.cool.mysite.com']);
 		assert.strictEqual(Host.lookUpWildcardParent('other.example.com'), undefined);
 	});
+
+	// Regression: the common case -- an already-existing single-label subdomain
+	// (its own auto-SSL/HTTP-01 host) sitting beside a wildcard, e.g.
+	// sso.nl.wgnode.com under *.nl.wgnode.com. The wildcard is a SIBLING of the
+	// subdomain's leftmost label, not a child of its node, so the old walk (which
+	// consumed "sso" and only checked that leaf's "*" child) never found it and
+	// the edit form's "Parent Wildcard" option stayed permanently greyed out.
+	test('lookUpWildcardParent finds a sibling wildcard for an existing single-label subdomain', async () => {
+		await populateTree(Host, ['sso.nl.wgnode.com', '*.nl.wgnode.com']);
+		const result = Host.lookUpWildcardParent('sso.nl.wgnode.com');
+		assert.ok(result, 'Should find the sibling wildcard');
+		assert.strictEqual(result.host, '*.nl.wgnode.com');
+	});
+
+	// A subdomain with no leaf of its own (never created) is deliberately NOT
+	// this method's job -- the walk stops before reaching the sibling "*" slot.
+	// The route resolves that case via plain lookUp()'s wildcard fallback first
+	// (covered in the route-fallback describe block below).
+	test('lookUpWildcardParent returns undefined for a subdomain with no leaf of its own', async () => {
+		await populateTree(Host, ['*.nl.wgnode.com']);
+		assert.strictEqual(Host.lookUpWildcardParent('api.nl.wgnode.com'), undefined);
+	});
+
+	test('lookUpWildcardParent does not treat a deeper wildcard as covering a shallower host', async () => {
+		// *.deep.nl.wgnode.com must NOT be offered as a parent for sso.nl.wgnode.com
+		// (a single-level wildcard covers only its own direct children).
+		await populateTree(Host, ['sso.nl.wgnode.com', '*.deep.nl.wgnode.com']);
+		assert.strictEqual(Host.lookUpWildcardParent('sso.nl.wgnode.com'), undefined);
+	});
 });
 
 /**
@@ -231,6 +260,24 @@ describe('Host wildcard-parent route fallback (lookUp then lookUpWildcardParent)
 		await populateTree(Host, ['cool.mysite.com']);
 		assert.strictEqual(findWildcardParent('cool.mysite.com'), null);
 	});
+
+	// The user's scenario: sso.nl.wgnode.com already exists as its own host, and
+	// a *.nl.wgnode.com wildcard is added afterward. lookUp() resolves to sso's
+	// own (non-wildcard) leaf, so the fallback to lookUpWildcardParent() is what
+	// surfaces the sibling wildcard and lets the edit form offer conversion.
+	test('finds the sibling wildcard for an already-existing single-label subdomain', async () => {
+		await populateTree(Host, ['sso.nl.wgnode.com', '*.nl.wgnode.com']);
+		const result = findWildcardParent('sso.nl.wgnode.com');
+		assert.ok(result);
+		assert.strictEqual(result.host, '*.nl.wgnode.com');
+	});
+
+	test('finds the sibling wildcard for a never-created single-label subdomain', async () => {
+		await populateTree(Host, ['*.nl.wgnode.com']);
+		const result = findWildcardParent('api.nl.wgnode.com');
+		assert.ok(result);
+		assert.strictEqual(result.host, '*.nl.wgnode.com');
+	});
 });
 
 /**
@@ -265,11 +312,17 @@ function createMockHostClassWithWildcardParentFix() {
 
 		static lookUpWildcardParent(host) {
 			let place = this.lookUpObj;
+			let parent = undefined;
 			for(let fragment of host.split('.').reverse()){
-				if(!place[fragment]) return undefined;
+				if(!place[fragment]){ place = undefined; break; }
+				parent = place;
 				place = place[fragment];
 			}
-			if(place['*'] && place['*']['#record']) return place['*']['#record'];
+			// Case 1: wildcard is a child of host's own node (base domain).
+			if(place && place['*'] && place['*']['#record']) return place['*']['#record'];
+			// Case 2: wildcard is a sibling of host's leftmost label
+			// (single-label subdomain, e.g. sso.nl.wgnode.com -> *.nl.wgnode.com).
+			if(parent && parent['*'] && parent['*']['#record']) return parent['*']['#record'];
 		}
 	};
 }

nodejs/test/unit/oidc.test.js

@@ -4,7 +4,7 @@ const {describe, test} = require('node:test');
 const assert = require('node:assert');
 const crypto = require('crypto');
 
-const oidc = require('../../utils/oidc');
+const oidc = require('@simpleworkjs/oidc-client').oidc;
 const conf = require('@simpleworkjs/conf');
 
 /**

nodejs/test/unit/safe_redirect.test.js

@@ -3,7 +3,7 @@
 const {describe, test} = require('node:test');
 const assert = require('node:assert');
 
-const {safeInternalPath} = require('../../utils/safe_redirect');
+const {safeInternalPath} = require('@simpleworkjs/oidc-client');
 
 /**
  * safeInternalPath guards the OIDC post-login redirect against open-redirect

nodejs/utils/build_info.js

@@ -1,29 +1,16 @@
 'use strict';
 
-const fs = require('fs');
+// Unified build-info shape ({ buildVersion, buildHash, buildYear }) via the
+// shared @simpleworkjs/app-stack. The baked commit file lives at nodejs/.build_commit
+// (../ from here in utils/), matching the Dockerfile gitinfo stage; cwd is
+// utils/ for the bare-metal git fallback.
+
 const path = require('path');
-const { execSync } = require('child_process');
+const { createBuildInfo } = require('@simpleworkjs/app-stack');
-const { version: buildVersion } = require('../package.json');
+const { version } = require('../package.json');
 
-// Docker builds bake the commit hash into ../.build_commit (see the gitinfo
+module.exports = createBuildInfo({
-// stage in Dockerfile) -- the final image has no git binary and no .git
+	version,
-// directory, so `git rev-parse` below always fails there. Bare-metal/dev
+	buildCommitPath: path.join(__dirname, '../.build_commit'),
-// runs have no baked file, so they fall back to asking git directly.
+	cwd: __dirname,
-function readBuildHash() {
+});
-	try {
-		const baked = fs.readFileSync(path.join(__dirname, '../.build_commit'), 'utf8').trim();
-		if (baked) return baked;
-	} catch (_) {}
-
-	try {
-		return execSync('git rev-parse --short HEAD', { cwd: __dirname }).toString().trim();
-	} catch (_) {
-		return 'unknown';
-	}
-}
-
-module.exports = {
-	buildVersion,
-	buildHash: readBuildHash(),
-	buildYear: new Date().getFullYear(),
-};

nodejs/utils/host_features.js

@@ -252,6 +252,7 @@ function normalizeHostFeatures(body){
 	if('sso_enabled' in body) body.sso_enabled = toBool(body.sso_enabled);
 	if('sso_allow_users' in body)  body.sso_allow_users  = parseAllowList(body.sso_allow_users);
 	if('sso_allow_groups' in body) body.sso_allow_groups = parseAllowList(body.sso_allow_groups);
+	if('targets' in body) body.targets = parseAllowList(body.targets);
 
 	if('ratelimit_rate' in body)  body.ratelimit_rate  = clampNumber(body.ratelimit_rate, 1, 1000000, 10);
 	if('ratelimit_burst' in body) body.ratelimit_burst = clampNumber(body.ratelimit_burst, 0, 1000000, 20);

nodejs/utils/oidc.js

@@ -1,127 +0,0 @@
-'use strict';
-
-const crypto = require('crypto');
-const conf = require('@simpleworkjs/conf');
-
-/**
- * Minimal OpenID Connect authorization-code + PKCE client.
- *
- * The SSO publishes no jwks_uri, so we do not verify ID-token signatures;
- * instead we treat the flow as opaque and read identity from the userinfo
- * endpoint (the access token is exchanged server-side over TLS). Uses Node's
- * global fetch (Node 18+) and crypto — no external dependency.
- *
- * All endpoints and client config come from conf.oidc (+ clientSecret from
- * secrets.js, deep-merged by @simpleworkjs/conf).
- */
-
-const base64url = buf => buf.toString('base64')
-	.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-
-// A high-entropy random string for `state` / PKCE verifier.
-function randomToken(bytes = 32){
-	return base64url(crypto.randomBytes(bytes));
-}
-
-// PKCE S256 challenge derived from the verifier.
-function codeChallengeS256(verifier){
-	return base64url(crypto.createHash('sha256').update(verifier).digest());
-}
-
-// Generate the {state, codeVerifier, codeChallenge} triple for a new login.
-function createAuthRequest(){
-	let state = randomToken(32);
-	let codeVerifier = randomToken(32);
-	let codeChallenge = codeChallengeS256(codeVerifier);
-	return {state, codeVerifier, codeChallenge};
-}
-
-// Build the SSO authorize URL the browser is redirected to. `redirectUri`
-// overrides conf.oidc.redirectUri (per-host SSO uses a per-host callback).
-function buildAuthUrl(state, codeChallenge, redirectUri){
-	let o = conf.oidc;
-	let params = new URLSearchParams({
-		response_type: 'code',
-		client_id: o.clientId,
-		redirect_uri: redirectUri || o.redirectUri,
-		scope: (o.scopes || ['openid', 'profile', 'email', 'groups']).join(' '),
-		state,
-		code_challenge: codeChallenge,
-		code_challenge_method: 'S256',
-	});
-	return `${o.authorizationEndpoint}?${params.toString()}`;
-}
-
-// Exchange an authorization code for tokens at the token endpoint. `redirectUri`
-// must match the one used in buildAuthUrl (per-host for per-host SSO).
-async function exchangeCode(code, codeVerifier, redirectUri){
-	let o = conf.oidc;
-	let body = new URLSearchParams({
-		grant_type: 'authorization_code',
-		code,
-		redirect_uri: redirectUri || o.redirectUri,
-		client_id: o.clientId,
-		client_secret: o.clientSecret,
-		code_verifier: codeVerifier,
-	});
-
-	let res = await fetch(o.tokenEndpoint, {
-		method: 'POST',
-		headers: {
-			'Content-Type': 'application/x-www-form-urlencoded',
-			'Accept': 'application/json',
-		},
-		body: body.toString(),
-	});
-
-	if(!res.ok){
-		let text = await res.text().catch(() => '');
-		let error = new Error('OidcTokenExchangeFailed');
-		error.name = 'OidcTokenExchangeFailed';
-		error.message = `Token exchange failed (${res.status}): ${text}`;
-		error.status = 502;
-		throw error;
-	}
-
-	return res.json();
-}
-
-// Fetch the userinfo claims for an access token.
-async function fetchUserInfo(accessToken){
-	let o = conf.oidc;
-	let res = await fetch(o.userinfoEndpoint, {
-		headers: {
-			'Authorization': `Bearer ${accessToken}`,
-			'Accept': 'application/json',
-		},
-	});
-
-	if(!res.ok){
-		let error = new Error('OidcUserInfoFailed');
-		error.name = 'OidcUserInfoFailed';
-		error.message = `Userinfo request failed (${res.status})`;
-		error.status = 502;
-		throw error;
-	}
-
-	return res.json();
-}
-
-// Pull the app username and group list out of userinfo claims per conf.
-function claimsToIdentity(claims){
-	let o = conf.oidc;
-	let username = claims[o.usernameClaim || 'preferred_username'] || claims.sub;
-	let groups = claims[o.groupsClaim || 'groups'] || [];
-	if(!Array.isArray(groups)) groups = [groups].filter(Boolean);
-	return {username, groups, claims};
-}
-
-module.exports = {
-	randomToken,
-	codeChallengeS256,
-	createAuthRequest,
-	buildAuthUrl,
-	exchangeCode,
-	fetchUserInfo,
-	claimsToIdentity,
-};

nodejs/utils/safe_redirect.js

@@ -1,23 +0,0 @@
-'use strict';
-
-/**
- * Constrain a post-login redirect target to a same-origin path.
- *
- * Rejects anything that could leave the site or execute script:
- *   - absolute URLs        ("https://evil.com")            -> not a "/" path
- *   - protocol-relative    ("//evil.com", "/\\evil.com")   -> host takeover
- *   - scheme targets       ("javascript:...", "data:...")  -> XSS
- * Anything not a plain "/path" falls back to "/".
- *
- * The browser has its own copy of this in public/lib/js/app-base.js; keep the
- * two in sync.
- */
-function safeInternalPath(path){
-	if(typeof path !== 'string' || path.charAt(0) !== '/'
-			|| path.charAt(1) === '/' || path.charAt(1) === '\\'){
-		return '/';
-	}
-	return path;
-}
-
-module.exports = {safeInternalPath};

nodejs/utils/unix_socket_json.js

@@ -27,12 +27,14 @@ class SocketServerJson {
 		this.onClientClose = new CallbackQueue(args.onClientClose);
 		this.onClientError = new CallbackQueue(args.onClientError);
 
-		// Set socket file permissions after listening
+		// Set socket file permissions after listening. 660 (owner + group read/write)
-		// 777 is acceptable here for single-use container environments
+		// is the safest default; the Docker image runs both processes as root, and
-		// Wrapped in try-catch as chmod may fail in test/restricted environments
+		// bare-metal operators should ensure the proxy service and openresty share a
+		// group when running as separate users. Wrapped in try-catch as chmod may
+		// fail in test/restricted environments.
 		this.onListen.push(() => {
 			try {
-				fs.chmodSync(this.socketFile, '777');
+				fs.chmodSync(this.socketFile, '660');
 			} catch(err) {
 				// Chmod may fail in test environments or certain filesystems
 				// Socket will still work with default permissions

nodejs/views/hosts.ejs

@@ -232,6 +232,7 @@
 		});
 
 		$f.find("textarea[name='req_headers']").val(hostFeatureHeadersToText(h.req_headers));
+		$f.find("textarea[name='targets']").val(hostFeatureListToText(h.targets));
 		$f.find("textarea[name='resp_headers']").val(hostFeatureHeadersToText(h.resp_headers));
 		$f.find("textarea[name='ip_allow']").val(hostFeatureListToText(h.ip_allow));
 		$f.find("textarea[name='ip_deny']").val(hostFeatureListToText(h.ip_deny));
@@ -632,6 +633,14 @@
 									<small class="field-help text-muted d-block">Whether the proxy talks to the target over HTTP or HTTPS. Independent of Incoming SSL above — clients can use HTTPS to reach the proxy while it still talks plain HTTP to the target, or vice versa.</small>
 								</div>
 							</div>
+
+							<hr>
+
+							<div class="form-group">
+								<label for="targets" class="form-label">Additional Targets (Load Balancing)</label>
+								<textarea name="targets" class="form-control" rows="2" placeholder="10.0.0.2:8080&#10;10.0.0.3:8080"></textarea>
+								<small class="field-help text-muted d-block">Add additional targets here (IP:port, one per line) to load balance across them using round-robin. The primary target above is always included.</small>
+							</div>
 						</div>
 
 						<!-- TLS & Wildcard -->

ops/install.sh

@@ -123,6 +123,7 @@ apt-get install -y nodejs openresty
 echo "==> Lua modules"
 luarocks install lua-resty-auto-ssl
 luarocks install luasocket
+luarocks install lua-resty-balancer
 # CIDR matcher for the per-host IP allow/deny lists (hostfeatures.lua).
 # resty.limit.req is bundled with OpenResty, so no rock is needed for it.
 luarocks install lua-resty-ipmatcher

ops/nginx_conf/targetinfo.lua

@@ -62,6 +62,7 @@ function M.get(ngx, domain, targetInfo)
 
     local json = require "cjson"
     local redis = require "resty.redis"
+    local roundrobin = require "resty.roundrobin"
 
     if not domain then
         return nil, 499
@@ -95,6 +96,44 @@ function M.get(ngx, domain, targetInfo)
         return nil, 406
     end
 
+    -- Load balancing
+    local target_list = {}
+    table.insert(target_list, res["ip"] .. ":" .. tostring(res["targetPort"]))
+    
+    if res["targets"] and res["targets"] ~= "" and res["targets"] ~= "[]" then
+        local decodeOk, decodedTargets = pcall(json.decode, res["targets"])
+        if decodeOk and type(decodedTargets) == "table" then
+            for _, t in ipairs(decodedTargets) do
+                table.insert(target_list, t)
+            end
+        end
+    end
+
+    if #target_list > 1 then
+        if not M.host_balancers then M.host_balancers = {} end
+        local cache_key = domain .. "_" .. (res["updated_on"] or "0")
+        
+        if not M.host_balancers[domain] or M.host_balancers[domain].key ~= cache_key then
+            local nodes = {}
+            for _, t in ipairs(target_list) do
+                nodes[t] = 1
+            end
+            local b = roundrobin:new(nodes)
+            M.host_balancers[domain] = { b = b, key = cache_key }
+        end
+        
+        local peer = M.host_balancers[domain].b:find()
+        if peer then
+            local colon = peer:find(":")
+            if colon then
+                res["ip"] = peer:sub(1, colon - 1)
+                res["targetPort"] = peer:sub(colon + 1)
+            else
+                res["ip"] = peer
+            end
+        end
+    end
+
     ngx.ctx.targetInfo = res
     -- Remember which host this target was resolved for, so the reuse guard at
     -- the top can tell a genuine cache hit from a coalesced request for a

secrets.js.example

@@ -67,12 +67,14 @@ module.exports = {
         adminUsers: ['proxyadmin'],
         groupRoleMap: {},
         // Optional: the local anti-lockout admin's initial password, used
-        // ONLY the first time that account is created. Leave unset and it
+        // ONLY the first time that account is created. Leave unset and a
-        // defaults to the username itself ("proxyadmin2") — fine for a quick
+        // random password is generated and printed to the container log on
-        // local test, but change it (or set this) before exposing the proxy
+        // first boot — fine for a quick local test if you copy it from the
-        // publicly. Once the account exists, this key is never read again;
+        // log right away, but set this (or change the password afterward)
-        // change the password via the app itself (or delete the Redis user
+        // before exposing the proxy publicly. Once the account exists, this
-        // to force it to be re-bootstrapped with a new value here).
+        // key is never read again; change the password via the app itself
+        // (or delete the Redis user to force it to be re-bootstrapped with a
+        // new value here).
         // localAdminPass: 'change-me',
     },