Merge pull request #209 from theta42/fix/sync-version-v1.32.0

fix: sync package version to v1.32.0 tag

CHANGELOG.md

@@ -1,3 +1,9 @@
+## v1.13.3
+- fix: remove missing DEPLOYMENT.md and docs/ from Docker build context
+
+## v1.13.2
+- chore: Update CI pipeline integration
+
 # Changelog
 
 All notable changes to this project are documented here. Format loosely
@@ -6,6 +12,45 @@ correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.
 
 ## [Unreleased]
 
+## [1.13.1] - 2026-08-01
+
+### Fixed
+- **Bumped `@simpleworkjs/bao-conf` to 1.0.1** so standalone/no-OpenBao boots
+  don't crash. bao-conf 1.0.0's `init()` threw when `VAULT_TOKEN` was unset,
+  which — combined with `bin/www`'s `.catch(() => process.exit(1))` — made the
+  proxy exit at boot in any deployment without an OpenBao sidecar (standalone
+  Docker, bare metal). 1.0.1 makes `init()` fail-soft on a missing token (warn
+  + continue from `CONF_SECRETS`), matching the documented contract. The
+  theta-env stack is unaffected (it always sets a scoped `VAULT_TOKEN`).
+
+## [1.13.0] - 2026-08-01
+
+### Changed
+- **Secrets now load from OpenBao at boot** via
+  [@simpleworkjs/bao-conf](https://simpleworkjs.github.io/bao-conf/), which
+  deep-merges `secret/proxy/conf` over the file-loaded config. The proxy
+  authenticates to OpenBao with a scoped `VAULT_TOKEN` (policy `proxy` —
+  read-only on its own path), never the root token. Because the OIDC
+  `clientSecret` is captured at require time inside `createOidcClient` (during
+  `require('../models')`, which `require('../app')` triggers transitively),
+  `bin/www` now defers `require('../app')` until after `bao-conf.init()`
+  resolves. Fail-soft: if OpenBao is unreachable, boot continues from
+  `CONF_SECRETS`. The `config/proxy-secrets.js` file is now an operator-edit
+  seed artifact (gitignored); OpenBao is authoritative. See theta-env's
+  [Secrets docs](https://theta42.github.io/theta-env/secrets/).
+- Bumped package version to track the release tag.
+
+## [1.12.1] - 2026-08-01
+
+### Changed
+- Bumped `body-parser` 2.2.2 → 2.3.0 (Dependabot #175).
+- Bumped `ejs` and `brace-expansion` (Dependabot #179, security maintenance).
+
+## [1.12.0] - 2026-08-01
+
+### Fixed
+- Changed UNIX socket permission in `unix_socket_json.js` to `666` so OpenResty Nginx workers running as `nobody` can resolve targets properly.
+
 ## [1.9.0] - 2026-07-30
 
 ### Added

Dockerfile

@@ -115,8 +115,6 @@ COPY nodejs/api.md ./api.md
 # docs/ mirrors the repo's own top-level docs/ folder.
 COPY README.md /README.md
 COPY CHANGELOG.md /CHANGELOG.md
-COPY DEPLOYMENT.md /DEPLOYMENT.md
-COPY docs /docs
 
 # Baked commit hash from the gitinfo stage (see build_info.js).
 COPY --from=gitinfo /commit.txt ./.build_commit

README.md

@@ -162,6 +162,23 @@ docker compose exec proxy tail -f /var/log/nginx/error.log
 docker compose logs --tail=200 --since=10m proxy
 ```
 
+## Secrets
+
+Secrets are loaded from **OpenBao** at boot via
+[@simpleworkjs/bao-conf](https://simpleworkjs.github.io/bao-conf/), which
+deep-merges `secret/proxy/conf` over the file-loaded config. The proxy's OIDC
+`clientSecret` is captured at require time (inside `createOidcClient` during
+`require('../models')`), so `bin/www` runs `bao-conf.init()` **before**
+`require('../app')` (which transitively loads models). Fail-soft: if OpenBao is
+unreachable, boot continues from `CONF_SECRETS`. The proxy authenticates to
+OpenBao with the scoped `VAULT_TOKEN` (env, policy `proxy` — read only
+`secret/proxy/conf`), never the root token.
+
+The `config/proxy-secrets.js` file is an operator-edit seed artifact
+(gitignored); the bootstrap writes the generated OAuth client creds into
+OpenBao, which is authoritative. For the full architecture see theta-env's
+**[Secrets docs](https://theta42.github.io/theta-env/secrets/)**.
+
 ## Manual Installation
 
 For manual installation or other distributions, see the detailed steps below.

nodejs/bin/www

@@ -4,34 +4,91 @@
  * Module dependencies.
  */
 
-var app = require('../app');
-var debug = require('debug')('proxy-api:server');
-var http = require('http');
 const conf = require('@simpleworkjs/conf');
+const debug = require('debug')('proxy-api:server');
+const http = require('http');
 
-/**
+// @simpleworkjs/conf loads ./config/proxy-secrets.js synchronously, then
- * Get port from environment and store in Express.
+// @simpleworkjs/bao-conf deep-merges secret/proxy/conf from OpenBao over it.
- */
+// The OIDC clientSecret is captured at require time inside models (via
+// createOidcClient), and require('../app') transitively loads models, so the
+// OpenBao fetch MUST resolve before require('../app'). Fail-soft: if OpenBao
+// is unreachable, init() leaves conf as the file-loaded fallback and boot
+// continues from ./config/proxy-secrets.js.
+require('@simpleworkjs/bao-conf').init({ path: 'proxy', conf }).then(() => {
+  var app = require('../app');   // models + createOidcClient now see merged conf
 
-var port = normalizePort(process.env.NODE_PORT || conf.port || '3000');
+  /**
-app.set('port', port);
+   * Get port from environment and store in Express.
+   */
 
-/**
+  var port = normalizePort(process.env.NODE_PORT || conf.port || '3000');
- * Create HTTP server.
+  app.set('port', port);
- */
 
-var server = http.createServer(app);
+  /**
+   * Create HTTP server.
+   */
 
-var io = require('socket.io')(server);
+  var server = http.createServer(app);
-app.io = io;
 
-/**
+  var io = require('socket.io')(server);
- * Listen on provided port, on all network interfaces.
+  app.io = io;
- */
 
-server.listen(port);
+  /**
-server.on('error', onError);
+   * Listen on provided port, on all network interfaces.
-server.on('listening', onListening);
+   */
+
+  server.listen(port);
+  server.on('error', onError);
+  server.on('listening', onListening);
+
+  /**
+   * Event listener for HTTP server "error" event.
+   */
+
+  function onError(error) {
+    if (error.syscall !== 'listen') {
+      throw error;
+    }
+
+    var bind = typeof port === 'string'
+      ? 'Pipe ' + port
+      : 'Port ' + port;
+
+    // handle specific listen errors with friendly messages
+    switch (error.code) {
+      case 'EACCES':
+        console.error(bind + ' requires elevated privileges');
+        process.exit(1);
+        break;
+      case 'EADDRINUSE':
+        console.error(bind + ' is already in use');
+        process.exit(1);
+        break;
+      default:
+        throw error;
+    }
+  }
+
+  /**
+   * Event listener for HTTP server "listening" event.
+   */
+
+  function onListening() {
+    var addr = server.address();
+    var bind = typeof addr === 'string'
+      ? 'pipe ' + addr
+      : 'port ' + addr.port;
+    console.log('Listening on ' + bind);
+
+    for(let listener of app.onListen){
+      listener()
+    }
+  }
+}).catch(err => {
+  console.error('boot failed:', err);
+  process.exit(1);
+});
 
 /**
  * Normalize a port into a number, string, or false.
@@ -51,48 +108,4 @@ function normalizePort(val) {
   }
 
   return false;
-}
+}
-
-/**
- * Event listener for HTTP server "error" event.
- */
-
-function onError(error) {
-  if (error.syscall !== 'listen') {
-    throw error;
-  }
-
-  var bind = typeof port === 'string'
-    ? 'Pipe ' + port
-    : 'Port ' + port;
-
-  // handle specific listen errors with friendly messages
-  switch (error.code) {
-    case 'EACCES':
-      console.error(bind + ' requires elevated privileges');
-      process.exit(1);
-      break;
-    case 'EADDRINUSE':
-      console.error(bind + ' is already in use');
-      process.exit(1);
-      break;
-    default:
-      throw error;
-  }
-}
-
-/**
- * Event listener for HTTP server "listening" event.
- */
-
-function onListening() {
-  var addr = server.address();
-  var bind = typeof addr === 'string'
-    ? 'pipe ' + addr
-    : 'port ' + addr.port;
-  console.log('Listening on ' + bind);
-
-  for(let listener of app.onListen){
-    listener()
-  }
-}

nodejs/models/dns_provider.js

@@ -3,6 +3,7 @@
 const crypto = require("crypto");
 
 const conf = require('@simpleworkjs/conf');
+const baoConf = require('@simpleworkjs/bao-conf');
 const Table = require('.');
 const ModelPs = require('../utils/model_pubsub');
 
@@ -139,11 +140,26 @@ class DnsProvider extends Table{
 			let __intraModel = this.__intraModel(data.dnsProvider);
 			Provider = __intraModel.Provider;
 
+			if (!data.id) data.id = crypto.randomBytes(8).toString("hex");
+
+			let secrets = {};
+			for (let key in Provider._keyMap) {
+				if (Provider._keyMap[key].isPrivate && data[key] !== undefined) {
+					secrets[key] = data[key];
+				}
+			}
+
 			// This is here test if the given API key is valid
 			let provider = new __intraModel.Provider(data, ...args);
 			let domains = await provider.listDomains();
 
+			for (let key in secrets) data[key] = '********';
+
 			let instance = await super.create.call(__intraModel, data, ...args);
+			
+			if (Object.keys(secrets).length > 0) {
+				await baoConf.set(`proxy/dns-providers/${instance.id}`, secrets);
+			}
 			try{
 				await instance.updateDomains(domains);
 			}catch(updateError){
@@ -189,7 +205,63 @@ class DnsProvider extends Table{
 		let instance = await super.get(data, ...args);
 		let __intraModel = this.__intraModel(instance.dnsProvider);
 
-		return await super.get.call(__intraModel, data, ...args);
+		let resolved = await super.get.call(__intraModel, data, ...args);
+		try {
+			let secrets = await baoConf.get(`proxy/dns-providers/${resolved.id}`);
+			if (secrets) Object.assign(resolved, secrets);
+		} catch(e) {}
+		return resolved;
+	}
+
+	static async findall(...args){
+		let instances = await super.findall(...args);
+		for (let inst of instances) {
+			try {
+				let secrets = await baoConf.get(`proxy/dns-providers/${inst.id}`);
+				if (secrets) Object.assign(inst, secrets);
+			} catch(e) {}
+		}
+		return instances;
+	}
+
+	static async find(...args){
+		let instances = await super.find(...args);
+		for (let inst of instances) {
+			try {
+				let secrets = await baoConf.get(`proxy/dns-providers/${inst.id}`);
+				if (secrets) Object.assign(inst, secrets);
+			} catch(e) {}
+		}
+		return instances;
+	}
+
+	async update(data){
+		let Provider = this.constructor.Provider || providers[this.dnsProvider];
+		let secrets = {};
+		if (Provider) {
+			for (let key in Provider._keyMap) {
+				if (Provider._keyMap[key].isPrivate && data[key] !== undefined && data[key] !== '********') {
+					secrets[key] = data[key];
+					data[key] = '********';
+				} else if (Provider._keyMap[key].isPrivate && data[key] === '********') {
+					delete data[key]; // Do not update the masked value if it's sent back
+				}
+			}
+		}
+
+		let res = await super.update(data);
+		
+		if (Object.keys(secrets).length > 0) {
+			let existing = await baoConf.get(`proxy/dns-providers/${this.id}`) || {};
+			await baoConf.set(`proxy/dns-providers/${this.id}`, { ...existing, ...secrets });
+			Object.assign(this, secrets);
+		}
+		return res;
+	}
+
+	async remove(...args){
+		await baoConf.request('DELETE', `proxy/dns-providers/${this.id}`).catch(()=>{});
+		return await super.remove(...args);
 	}
 
 	static listProviders(){

nodejs/package-lock.json

@@ -1,17 +1,18 @@
 {
   "name": "proxy-api",
-  "version": "1.7.0",
+  "version": "1.32.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "proxy-api",
-      "version": "1.7.0",
+      "version": "1.32.0",
       "license": "MIT",
       "dependencies": {
         "@fortawesome/fontawesome-free": "^7.3.0",
         "@popperjs/core": "^2.11.8",
         "@simpleworkjs/app-stack": "^1.0.0",
+        "@simpleworkjs/bao-conf": "^1.0.0",
         "@simpleworkjs/conf": "^1.2.0",
         "@simpleworkjs/frontend": "^0.2.7",
         "@simpleworkjs/ldap": "^1.0.0",
@@ -21,7 +22,7 @@
         "bcrypt": "^6.0.0",
         "bootstrap": "^5.3.8",
         "compression": "^1.8.1",
-        "ejs": "^3.1.10",
+        "ejs": "^6.0.1",
         "express": "^5.2.1",
         "express-rate-limit": "^8.5.2",
         "extend": "^3.0.2",
@@ -297,6 +298,18 @@
         "node": ">=18.0.0"
       }
     },
+    "node_modules/@simpleworkjs/bao-conf": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@simpleworkjs/bao-conf/-/bao-conf-1.0.1.tgz",
+      "integrity": "sha512-mcay5NQ/w9ShpIAolMP/3f9TfXSLE+d5jrA4dTPOUHDjTkdsP7pe4hMmQUmwnniR59U1bGoRIVdXjvDbX3I5nw==",
+      "license": "MIT",
+      "dependencies": {
+        "extend": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@simpleworkjs/conf": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/@simpleworkjs/conf/-/conf-1.2.0.tgz",
@@ -446,12 +459,6 @@
         "node": ">=12.0.0"
       }
     },
-    "node_modules/async": {
-      "version": "3.2.6",
-      "resolved": "https://registry.npmjs.org/async/-/async-3.2.6.tgz",
-      "integrity": "sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==",
-      "license": "MIT"
-    },
     "node_modules/asynckit": {
       "version": "0.4.0",
       "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
@@ -517,20 +524,20 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "2.2.2",
+      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.2.2.tgz",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
-      "integrity": "sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==",
+      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
       "license": "MIT",
       "dependencies": {
         "bytes": "^3.1.2",
-        "content-type": "^1.0.5",
+        "content-type": "^2.0.0",
         "debug": "^4.4.3",
-        "http-errors": "^2.0.0",
+        "http-errors": "^2.0.1",
-        "iconv-lite": "^0.7.0",
+        "iconv-lite": "^0.7.2",
         "on-finished": "^2.4.1",
-        "qs": "^6.14.1",
+        "qs": "^6.15.2",
-        "raw-body": "^3.0.1",
+        "raw-body": "^3.0.2",
-        "type-is": "^2.0.1"
+        "type-is": "^2.1.0"
       },
       "engines": {
         "node": ">=18"
@@ -540,6 +547,19 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/body-parser/node_modules/content-type": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
+      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/bootstrap": {
       "version": "5.3.8",
       "resolved": "https://registry.npmjs.org/bootstrap/-/bootstrap-5.3.8.tgz",
@@ -560,16 +580,16 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.7",
+      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/braces": {
@@ -848,18 +868,15 @@
       "license": "MIT"
     },
     "node_modules/ejs": {
-      "version": "3.1.10",
+      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/ejs/-/ejs-3.1.10.tgz",
+      "resolved": "https://registry.npmjs.org/ejs/-/ejs-6.0.1.tgz",
-      "integrity": "sha512-UeJmFfOrAQS8OJWPZ4qtgHyWExa088/MtK5UEyoJGFH67cDEXkZSviOiKRCZ4Xij0zxI3JECgYs3oKx+AizQBA==",
+      "integrity": "sha512-UaaM14yby8U3k02ihS1Bmj5Kz2d7CCQM1scxpgs4Mhkq8F1wR2gl3+Ts4h5Ne4Mnt7M9m4Dw7jsuMr3+xO4vZA==",
       "license": "Apache-2.0",
-      "dependencies": {
-        "jake": "^10.8.5"
-      },
       "bin": {
         "ejs": "bin/cli.js"
       },
       "engines": {
-        "node": ">=0.10.0"
+        "node": ">=0.12.18"
       }
     },
     "node_modules/encodeurl": {
@@ -1071,42 +1088,6 @@
       "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==",
       "license": "MIT"
     },
-    "node_modules/filelist": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/filelist/-/filelist-1.0.6.tgz",
-      "integrity": "sha512-5giy2PkLYY1cP39p17Ech+2xlpTRL9HLspOfEgm0L6CwBXBTgsK5ou0JtzYuepxkaQ/tvhCFIJ5uXo0OrM2DxA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "minimatch": "^5.0.1"
-      }
-    },
-    "node_modules/filelist/node_modules/balanced-match": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
-      "license": "MIT"
-    },
-    "node_modules/filelist/node_modules/brace-expansion": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
-      "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0"
-      }
-    },
-    "node_modules/filelist/node_modules/minimatch": {
-      "version": "5.1.9",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz",
-      "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
     "node_modules/fill-range": {
       "version": "7.1.1",
       "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
@@ -1483,23 +1464,6 @@
       "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==",
       "license": "MIT"
     },
-    "node_modules/jake": {
-      "version": "10.9.4",
-      "resolved": "https://registry.npmjs.org/jake/-/jake-10.9.4.tgz",
-      "integrity": "sha512-wpHYzhxiVQL+IV05BLE2Xn34zW1S223hvjtqk0+gsPrwd/8JNLXJgZZM/iPFsYc1xyphF+6M6EvdE5E9MBGkDA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "async": "^3.2.6",
-        "filelist": "^1.0.4",
-        "picocolors": "^1.1.1"
-      },
-      "bin": {
-        "jake": "bin/cli.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
     "node_modules/jq-repeat": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/jq-repeat/-/jq-repeat-2.2.0.tgz",
@@ -1806,12 +1770,6 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/picocolors": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
-      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
-      "license": "ISC"
-    },
     "node_modules/picomatch": {
       "version": "2.3.2",
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
@@ -2313,17 +2271,34 @@
       "license": "0BSD"
     },
     "node_modules/type-is": {
-      "version": "2.0.1",
+      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.0.1.tgz",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz",
-      "integrity": "sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw==",
+      "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==",
       "license": "MIT",
       "dependencies": {
-        "content-type": "^1.0.5",
+        "content-type": "^2.0.0",
         "media-typer": "^1.1.0",
         "mime-types": "^3.0.0"
       },
       "engines": {
-        "node": ">= 0.6"
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/type-is/node_modules/content-type": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
+      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/undefsafe": {

nodejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "proxy-api",
-  "version": "1.9.0",
+  "version": "1.32.0",
   "author": [
     {
       "name": "William Mantly",
@@ -22,6 +22,7 @@
     "@fortawesome/fontawesome-free": "^7.3.0",
     "@popperjs/core": "^2.11.8",
     "@simpleworkjs/app-stack": "^1.0.0",
+    "@simpleworkjs/bao-conf": "^1.0.0",
     "@simpleworkjs/conf": "^1.2.0",
     "@simpleworkjs/frontend": "^0.2.7",
     "@simpleworkjs/ldap": "^1.0.0",
@@ -31,7 +32,7 @@
     "bcrypt": "^6.0.0",
     "bootstrap": "^5.3.8",
     "compression": "^1.8.1",
-    "ejs": "^3.1.10",
+    "ejs": "^6.0.1",
     "express": "^5.2.1",
     "express-rate-limit": "^8.5.2",
     "extend": "^3.0.2",

nodejs/routes/render.js

@@ -55,7 +55,7 @@ router.get('/dns', async function(req, res, next) {
 
 
 router.get('/users', async function(req, res, next) {
-  res.render('users', {...values});
+  res.redirect(301, '/hosts');
 });
 
 router.get('/permissions', async function(req, res, next) {

nodejs/test/unit/dns_provider_vault.test.js

@@ -0,0 +1,67 @@
+const { describe, test, beforeEach, afterEach, after, mock } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+
+const baoConf = require('@simpleworkjs/bao-conf');
+const Table = require('../../models/index');
+const DnsProvider = Table.models.DnsProvider;
+const DuckDns = require('../../models/dns_provider/duckdns');
+
+describe('DnsProvider Vault Integration', () => {
+    let originalSet, originalGet, originalRequest;
+
+    after(async () => {
+        if (Table._redis && Table._redis.quit) {
+            await Table._redis.quit();
+        }
+    });
+
+    beforeEach(() => {
+        // Mock baoConf
+        originalSet = baoConf.set;
+        originalGet = baoConf.get;
+        originalRequest = baoConf.request;
+
+        const vaultStore = {};
+        baoConf.set = mock.fn(async (path, data) => { vaultStore[path] = data; return true; });
+        baoConf.get = mock.fn(async (path) => vaultStore[path] || {});
+        baoConf.request = mock.fn(async () => ({}));
+        
+        mock.method(DuckDns.prototype, 'listDomains', async () => []);
+        mock.method(DnsProvider.prototype, 'updateDomains', async () => {});
+    });
+
+    afterEach(() => {
+        baoConf.set = originalSet;
+        baoConf.get = originalGet;
+        baoConf.request = originalRequest;
+        mock.restoreAll();
+    });
+
+    test('create() writes isPrivate keys to OpenBao and get() retrieves them', async () => {
+        const payload = {
+            name: 'My Duck',
+            dnsProvider: 'DuckDns',
+            token: 'super-secret-vault-token',
+            subdomains: 'myduck',
+            created_by: 'admin'
+        };
+
+        const instance = await DnsProvider.create(payload);
+
+        // 1. Should have called OpenBao set
+        assert.strictEqual(baoConf.set.mock.callCount(), 1);
+        const [path, secrets] = baoConf.set.mock.calls[0].arguments;
+        
+        assert.strictEqual(path, `proxy/dns-providers/${instance.id}`);
+        assert.deepStrictEqual(secrets, { token: 'super-secret-vault-token' });
+
+        // 2. The returned instance should have the secret injected back
+        assert.strictEqual(instance.token, 'super-secret-vault-token');
+        
+        // 3. get() should fetch public data from Redis and merge secrets from OpenBao
+        // (baoConf.get is already mocked to return from vaultStore)
+        const fetched = await DnsProvider.get(instance.id);
+        assert.strictEqual(fetched.token, 'super-secret-vault-token');
+    });
+});

nodejs/utils/ui.js

@@ -38,7 +38,6 @@ module.exports = {
 	nav: [
 		{href: '/hosts', icon: 'fa-solid fa-network-wired', label: 'Hosts', groups: []},
 		{href: '/dns', icon: 'fa-solid fa-record-vinyl', label: 'DNS', groups: []},
-		{href: '/users', icon: 'fa-solid fa-users', label: 'Users', groups: ['admin']},
 		{href: '/permissions', icon: 'fa-solid fa-user-shield', label: 'Permissions', groups: ['admin']},
 		{href: '/groups', icon: 'fa-solid fa-users-gear', label: 'Groups', groups: ['admin']},
 	],

nodejs/views/groups.ejs

@@ -16,6 +16,14 @@
 
 <script type="text/javascript">
 
+	function loadGroups() {
+		app.group.list(function(error, data){
+			if(error) return app.messages.action(error, $('#groups-list'), 'danger');
+			$.scope.LocalGroup.empty();
+			for(let g of (data.results || [])) $.scope.LocalGroup.push(g);
+		});
+	}
+
 	// Usernames for the "add member" autocomplete (reuses the permission
 	// subjects endpoint, which is admin-only like this page).
 	function loadUserSuggestions(){
@@ -28,15 +36,16 @@
 
 	function removeGroup(name){
 		app.group.remove(name, function(error, data){
-			if(error) return app.messages.action(error, $.scope.LocalGroup.$this, 'danger');
+			if(error) return app.messages.action(error, $('#groups-list'), 'danger');
 			$.scope.LocalGroup.remove(name);
+			loadGroups();
 		});
 	}
 
 	function removeMember(group, username){
 		app.group.removeMember(group, username, function(error, data){
-			if(error) return app.messages.action(error, $.scope.LocalGroup.$this, 'danger');
+			if(error) return app.messages.action(error, $('#groups-list'), 'danger');
-			// websocket update echoes the new member list.
+			loadGroups();
 		});
 	}
 
@@ -47,17 +56,14 @@
 		let username = ($input.val() || '').trim();
 		if(!username) return;
 		app.group.addMember(group, username, function(error, data){
-			if(error) return app.messages.action(error, $.scope.LocalGroup.$this, 'danger');
+			if(error) return app.messages.action(error, $('#groups-list'), 'danger');
 			$input.val('');
+			loadGroups();
 		});
 	}
 
 	$(document).ready(function(){
-		app.group.list(function(error, data){
+		loadGroups();
-			if(error) return app.messages.action(error, $.scope.LocalGroup.$this, 'danger');
-			for(let g of data.results) $.scope.LocalGroup.push(g);
-		});
-
 		loadUserSuggestions();
 
 		$.scope.LocalGroup.__take = function($el){
@@ -66,14 +72,13 @@
 		};
 
 		app.subscribe(/^model:LocalGroup:create/, function(data){
-			$.scope.LocalGroup.remove(data.name);
+			loadGroups();
-			$.scope.LocalGroup.unshift(data);
 		});
 		app.subscribe(/^model:LocalGroup:update/, function(data, topic){
-			$.scope.LocalGroup.update(topic.split(':')[3], data);
+			loadGroups();
 		});
 		app.subscribe(/^model:LocalGroup:remove/, function(data, topic){
-			$.scope.LocalGroup.remove(topic.split(':')[3]);
+			loadGroups();
 		});
 	});
 </script>
@@ -81,61 +86,59 @@
 <div class="container mt-4">
 <datalist id="groupUsers"></datalist>
 
-<div class="row" style="display:none">
+<div class="row">
-	<div class="col-md-4">
+	<div class="col-md-4 mb-4">
-		<div class="card shadow-lg">
+		<div class="card shadow">
-			<div class="card-header text-center">
+			<div class="card-header d-flex justify-content-between align-items-center">
-				<span class="card-icon float-start"><i class="fa-solid fa-users-gear"></i></span>
+				<div><i class="fa-solid fa-users-gear me-2"></i><strong>Add Group</strong></div>
-				<span class="card-title">Add Group</span>
+				<a href="/docs/access" class="text-reset" title="Help"><i class="fa-solid fa-circle-question"></i></a>
-				<a href="/docs/access" class="text-reset float-end" title="Help"><i class="fa-solid fa-circle-question"></i></a>
 			</div>
 			<div class="card-header actionMessage" style="display:none"></div>
 			<div class="card-body">
-				<form action="group/" onsubmit="formAJAX(this)">
+				<form action="group/" onsubmit="formAJAX(this)" evalAJAX="loadGroups(); this.reset();">
-					<div class="form-group">
+					<div class="mb-3">
-						<label class="control-label">Group name</label>
+						<label class="form-label fw-bold">Group name</label>
-						<input type="text" class="form-control" name="name" placeholder="dns-team" autocomplete="off" />
+						<input type="text" class="form-control" name="name" placeholder="dns-team" autocomplete="off" required />
-						<div class="text-muted" style="font-size:.8rem">
+						<div class="form-text">
-							Lowercased to a slug. Use the name as a Subject (type "group")
+							Lowercased to a slug. Use the name as a Subject (type "group") on the Permissions page.
-							on the Permissions page.
 						</div>
 					</div>
 					<hr />
-					<button type="submit" class="btn btn-info">Add Group</button>
+					<button type="submit" class="btn btn-primary w-100"><i class="fa-solid fa-plus me-1"></i> Add Group</button>
 				</form>
 			</div>
 		</div>
 	</div>
 
-	<div class="col-md-8">
+	<div class="col-md-8 mb-4">
-		<div class="row row-cols-1 g-3">
+		<div class="row row-cols-1 g-3" id="groups-list">
 			<div jq-repeat="LocalGroup" jq-repeat-index="name" style="display:none" class="col">
-				<div class="card shadow-lg">
+				<div class="card shadow-sm border">
 					<div class="card-header d-flex align-items-center">
-						<span class="card-icon me-2"><i class="fa-solid fa-users"></i></span>
+						<span class="card-icon me-2"><i class="fa-solid fa-users text-primary"></i></span>
-						<span class="card-title">{{ name }}</span>
+						<strong class="me-2">{{ name }}</strong>
-						<span class="badge text-bg-secondary ms-2">{{ memberCount }} member(s)</span>
+						<span class="badge text-bg-secondary">{{ memberCount }} member(s)</span>
 						<button type="button" class="btn btn-sm btn-outline-danger ms-auto" onclick="removeGroup('{{name}}')">
 							<i class="fa-solid fa-trash"></i>
 						</button>
 					</div>
 					<div class="card-body">
-						<div class="mb-2">
+						<div class="mb-3">
 							{{#memberList}}
 							<span class="badge text-bg-info member-pill me-1 mb-1 fs-6">
 								{{ username }}
-								<i class="fa-solid fa-xmark ms-1" onclick="removeMember('{{group}}','{{username}}')"></i>
+								<i class="fa-solid fa-xmark ms-1 text-danger" onclick="removeMember('{{group}}','{{username}}')"></i>
 							</span>
 							{{/memberList}}
 							{{^memberList}}
-							<span class="text-muted">No members yet.</span>
+							<span class="text-muted small">No members yet.</span>
 							{{/memberList}}
 						</div>
-						<div class="input-group member-add" data-group="{{name}}">
+						<div class="input-group input-group-sm member-add" data-group="{{name}}">
-							<input type="text" class="form-control" list="groupUsers" placeholder="username" autocomplete="off"
+							<input type="text" class="form-control" list="groupUsers" placeholder="Add username..." autocomplete="off"
 								onkeydown="if(event.key==='Enter'){event.preventDefault();addMember(this.nextElementSibling);}" />
 							<button type="button" class="btn btn-success" onclick="addMember(this)">
-								<i class="fa-solid fa-user-plus"></i> Add
+								<i class="fa-solid fa-user-plus me-1"></i> Add
 							</button>
 						</div>
 					</div>

nodejs/views/permissions.ejs

@@ -4,21 +4,16 @@
 	app.auth.forceLogin();
 </script>
 
-<style type="text/css">
-	label.control-label{
-		font-weight: bold;
-		margin-bottom: 1px;
-	}
-	.card-title{
-		font-weight: bold;
-	}
-	.field-hint{
-		font-size: .8rem;
-	}
-</style>
-
 <script type="text/javascript">
 
+	function loadPermissions() {
+		app.permission.list(function(error, data){
+			if(error) return app.messages.action(error, $('#permissions-list'), 'danger');
+			$.scope.Permission.empty();
+			for(let p of (data.results || [])) $.scope.Permission.push(p);
+		});
+	}
+
 	// Fill the username/group datalists that back the Subject autocomplete.
 	function loadSubjectSuggestions(){
 		app.permission.subjects(function(error, data){
@@ -42,63 +37,61 @@
 
 	function permissionAddOpen(){
 		app.modal.open({title: 'Add Permission', bodyHtml:
-			'<form action="permission/" onsubmit="formAJAX(this)" evalAJAX="app.modal.close();">'
+			'<form action="permission/" onsubmit="formAJAX(this)" evalAJAX="app.modal.close(); loadPermissions();">'
-			+   '<div class="form-group">'
+			+   '<div class="mb-3">'
-			+     '<label class="control-label">Subject type</label>'
+			+     '<label class="form-label fw-bold">Subject type</label>'
-			+     '<select class="form-control" name="subjectType" onchange="subjectTypeChanged(this)">'
+			+     '<select class="form-select" name="subjectType" onchange="subjectTypeChanged(this)">'
 			+       '<option value="user">User</option>'
 			+       '<option value="group">Group</option>'
 			+     '</select>'
 			+   '</div>'
-			+   '<div class="form-group">'
+			+   '<div class="mb-3">'
-			+     '<label class="control-label">Subject (username or group)</label>'
+			+     '<label class="form-label fw-bold">Subject (username or group)</label>'
 			+     '<input type="text" class="form-control" name="subject" list="subjectUsers" placeholder="alice" autocomplete="off" />'
 			+   '</div>'
-			+   '<div class="form-group">'
+			+   '<div class="mb-3">'
-			+     '<label class="control-label">Scope</label>'
+			+     '<label class="form-label fw-bold">Scope</label>'
-			+     '<select class="form-control" name="scope">'
+			+     '<select class="form-select" name="scope">'
 			+       '<option value="domain">Domain</option>'
 			+       '<option value="global">Global</option>'
 			+     '</select>'
 			+   '</div>'
-			+   '<div class="form-group">'
+			+   '<div class="mb-3">'
-			+     '<label class="control-label">Domain (for domain scope)</label>'
+			+     '<label class="form-label fw-bold">Domain (for domain scope)</label>'
 			+     '<input type="text" class="form-control" name="domain" placeholder="example.com" autocomplete="off" />'
-			+     '<div class="field-hint text-muted">'
+			+     '<div class="form-text text-muted">'
 			+       'Wildcards: <code>*.example.com</code> matches one label, '
 			+       '<code>**.example.com</code> matches any depth (incl. the apex), '
 			+       '<code>**</code> matches every domain.'
 			+     '</div>'
 			+   '</div>'
-			+   '<div class="form-group">'
+			+   '<div class="mb-3">'
-			+     '<label class="control-label">Role</label>'
+			+     '<label class="form-label fw-bold">Role</label>'
-			+     '<select class="form-control" name="role">'
+			+     '<select class="form-select" name="role">'
 			+       '<option value="viewer">Viewer (read)</option>'
 			+       '<option value="manager">Manager (full over domain)</option>'
 			+       '<option value="admin">Admin (global only)</option>'
 			+     '</select>'
 			+   '</div>'
 			+   '<hr />'
-			+   '<button type="submit" class="btn btn-info">Add Permission</button>'
+			+   '<div class="d-flex justify-content-end gap-2">'
+			+     '<button type="button" class="btn btn-secondary" onclick="app.modal.close()">Cancel</button>'
+			+     '<button type="submit" class="btn btn-primary">Add Permission</button>'
+			+   '</div>'
 			+ '</form>',
 		});
 	}
 
 	function removePermission(id){
 		app.permission.remove(id, function(error, data){
-			if(error) return app.messages.action(error, $.scope.Permission.$this, 'danger');
+			if(error) return app.messages.action(error, $('#permissions-list'), 'danger');
-			// The websocket echo removes the row; drop it locally too for snappiness.
 			$.scope.Permission.remove(id);
+			loadPermissions();
 		});
 	}
 
 	$(document).ready(function(){
-		// Existing permissions.
+		loadPermissions();
-		app.permission.list(function(error, data){
-			if(error) return app.messages.action(error, $.scope.Permission.$this, 'danger');
-			for(let p of data.results) $.scope.Permission.push(p);
-		});
-
 		loadSubjectSuggestions();
 
 		$.scope.Permission.__take = function($el, item, list){
@@ -108,12 +101,10 @@
 
 		// Live updates (model:Permission:*), so adds/removes reflect for everyone.
 		app.subscribe(/^model:Permission:create/, function(data){
-			$.scope.Permission.remove(data.id);
+			loadPermissions();
-			$.scope.Permission.unshift(data);
-			setTimeout(function(){ app.util.revealItem($('#permission-row-' + data.id)); }, 100);
 		});
 		app.subscribe(/^model:Permission:remove/, function(data, topic){
-			$.scope.Permission.remove(topic.split(':')[3]);
+			loadPermissions();
 		});
 	});
 </script>
@@ -122,47 +113,48 @@
 <datalist id="subjectUsers"></datalist>
 <datalist id="subjectGroups"></datalist>
 
-<div class="row" style="display:none">
+<div class="row">
 	<div class="col-12">
-		<div class="card shadow-lg">
+		<div class="card shadow">
 
-			<div class="card-header text-center">
+			<div class="card-header d-flex justify-content-between align-items-center">
-				<span class="card-icon float-start">
+				<div>
-					<i class="fa-solid fa-list-check"></i>
+					<i class="fa-solid fa-user-shield me-2"></i><strong>Permissions List</strong>
-				</span>
+				</div>
-				<span class="card-title">Permissions</span>
+				<div>
-				<span class="float-end">
+					<a href="/docs/access" class="text-reset me-3" title="Help"><i class="fa-solid fa-circle-question"></i></a>
-					<a href="/docs/access" class="text-reset me-2" title="Help"><i class="fa-solid fa-circle-question"></i></a>
+					<button type="button" class="btn btn-sm btn-primary" onclick="permissionAddOpen()">
-					<button type="button" class="btn btn-sm btn-success" onclick="permissionAddOpen()">
+						<i class="fa-solid fa-user-shield me-1"></i> Add Permission
-						<i class="fa-solid fa-user-shield"></i>
-						Add Permission
 					</button>
-				</span>
+				</div>
 			</div>
 
 			<div class="card-header actionMessage" style="display:none"></div>
-			<div class="card-body">
+			<div class="card-body p-0">
-			<div class="row row-cols-1 row-cols-lg-2 g-3" id="permission-cards">
+				<ul class="list-group list-group-flush" id="permissions-list">
-				<div class="col" jq-repeat="Permission" jq-repeat-index="id" id="permission-row-{{id}}" style="display:none">
+					<li class="list-group-item d-flex align-items-center justify-content-between py-3" jq-repeat="Permission" jq-repeat-index="id" id="permission-row-{{id}}" style="display:none">
-					<div class="card shadow-sm h-100">
+						<div class="d-flex align-items-center">
-						<div class="card-body">
+							<div class="me-3 fs-4 text-primary">
-							<h6 class="mb-2">
+								<i class="fa-solid fa-user-check"></i>
-								<span class="badge text-bg-secondary">{{ subjectType }}</span>
+							</div>
-								{{ subject }}
+							<div>
-							</h6>
+								<h6 class="mb-1 fw-bold">
-							<dl class="row mb-2 small">
+									<span class="badge bg-secondary me-2">{{ subjectType }}</span> {{ subject }}
-								<dt class="col-4">Scope</dt><dd class="col-8">{{ scope }}</dd>
+								</h6>
-								<dt class="col-4">Domain</dt><dd class="col-8">{{ domain }}</dd>
+								<div class="small text-muted">
-								<dt class="col-4">Role</dt><dd class="col-8">{{ role }}</dd>
+									<span class="me-3"><strong>Scope:</strong> {{ scope }}</span>
-							</dl>
+									<span class="me-3"><strong>Domain:</strong> <code>{{ domain }}</code></span>
-							<button type="button" class="btn btn-sm btn-danger" onclick="removePermission('{{id}}')">
+									<span><strong>Role:</strong> <span class="badge bg-info text-dark">{{ role }}</span></span>
-								<i class="fa-solid fa-trash"></i>
+								</div>
-								Delete
+							</div>
+						</div>
+						<div>
+							<button type="button" class="btn btn-sm btn-outline-danger" onclick="removePermission('{{id}}')">
+								<i class="fa-solid fa-trash me-1"></i> Delete
 							</button>
 						</div>
-					</div>
+					</li>
-				</div>
+				</ul>
-			</div>
 			</div>
 		</div>
 	</div>