wmantly
a9a48c3445
Personal access tokens so scripts/CI can call the management API without an OIDC browser session. Each logged-in user mints their own token; it authenticates as the creator (groups snapshotted at mint, mirroring the proxy's browser AuthToken), and the existing authz layer (Permission.effectiveFor / roles.resolveEffective) applies unchanged. Local groups and owned-domain rights are recomputed live; only SSO/LDAP group membership is the mint-time snapshot. - models/api_token.js: new ApiToken model (prx_<id>_<secret> format; id is the lookup key, secret bcrypt-hashed + isPrivate, shown once). add()/rotate()/ authenticate(); optional expires_at; best-effort last_used_on; groups snapshot. No _ttl (persists). Deliberately NOT wrapped in ModelPs (so the last_used_on write on the auth path doesn't spam the socket). - routes/api_token.js: self-service CRUD (list/get/update/delete/rotate), owner-scoped (created_by === reqUsername(req), 403 otherwise). - middleware/auth.js + models/auth.js: accept `Authorization: Bearer prx_...` (precedence over the auth-token session header). Builds a synthetic req.token that satisfies the only three req.token reads (auth.js .user/.groupsArray, authz.js reqUsername .created_by) so the authz layer works unchanged. checkApiToken collapses every failure to one generic 401 (no leak). - views/api_tokens.ejs + routes/render.js (GET /api-tokens): self-service page (forceLogin, no admin gate) — create (token shown once), rotate, revoke. - views/top.ejs: "API Tokens" nav entry visible to all logged-in users. - public/js/app.js: app.apiToken client module. - DEPLOYMENT.md + docs/docker.md: API tokens section. Co-authored-by: Claude <noreply@anthropic.com>
80 lines
2.3 KiB
JavaScript
80 lines
2.3 KiB
JavaScript
'use strict';
|
|
|
|
const path = require('path');
|
|
const express = require('express');
|
|
const router = require('express').Router();
|
|
const conf = require('@simpleworkjs/conf');
|
|
|
|
const values ={
|
|
title: conf.environment !== 'production' ? `dev` : '',
|
|
titleIcon: conf.environment !== 'production' ? `<i class="fa-brands fa-dev"></i>` : '',
|
|
}
|
|
|
|
// List of front end node modules to be served
|
|
const frontEndModules = ['bootstrap', 'mustache', 'jquery', '@fortawesome',
|
|
'moment', '@popper', 'jq-repeat',
|
|
];
|
|
|
|
// Server front end modules
|
|
// https://stackoverflow.com/a/55700773/3140931
|
|
frontEndModules.forEach(dep => {
|
|
router.use(`/static-modules/${dep}`, express.static(path.join(__dirname, `../node_modules/${dep}`)))
|
|
});
|
|
|
|
// Have express server static content( images, CSS, browser JS) from the public
|
|
// local folder.
|
|
router.use('/static', express.static(path.join(__dirname, '../public')))
|
|
|
|
router.get('/', (req, res) => {
|
|
res.redirect(301, '/hosts');
|
|
});
|
|
|
|
// Lightweight liveness probe for container healthchecks / monitoring. No auth,
|
|
// no dependencies — just confirms the Express process is up and routing.
|
|
router.get('/health', (req, res) => {
|
|
res.json({status: 'ok'});
|
|
});
|
|
|
|
router.get('/hosts', async function(req, res, next) {
|
|
res.render('hosts', {...values});
|
|
});
|
|
|
|
router.get('/dns', async function(req, res, next) {
|
|
res.render('dns', {...values});
|
|
});
|
|
|
|
|
|
router.get('/users', async function(req, res, next) {
|
|
res.render('users', {...values});
|
|
});
|
|
|
|
router.get('/permissions', async function(req, res, next) {
|
|
res.render('permissions', {...values});
|
|
});
|
|
|
|
router.get('/groups', async function(req, res, next) {
|
|
res.render('groups', {...values});
|
|
});
|
|
|
|
router.get('/profile', async function(req, res, next) {
|
|
res.render('profile', {...values});
|
|
});
|
|
|
|
router.get('/api-tokens', async function(req, res, next) {
|
|
res.render('api_tokens', {...values});
|
|
});
|
|
|
|
// Bare /login (the OIDC callback redirect target) and /login/<path>.
|
|
router.get('/login', async function(req, res, next) {
|
|
res.render('login', {...values, redirect: req.query.redirect});
|
|
});
|
|
|
|
router.get('/login/*splat', async function(req, res, next) {
|
|
res.render('login', {...values, redirect: req.query.redirect});
|
|
});
|
|
|
|
router.get('/test', async function(req, res, next) {
|
|
res.render('test', {...values, redirect: req.query.redirect});
|
|
});
|
|
module.exports = router;
|