wmantly
a9a48c3445
Personal access tokens so scripts/CI can call the management API without an OIDC browser session. Each logged-in user mints their own token; it authenticates as the creator (groups snapshotted at mint, mirroring the proxy's browser AuthToken), and the existing authz layer (Permission.effectiveFor / roles.resolveEffective) applies unchanged. Local groups and owned-domain rights are recomputed live; only SSO/LDAP group membership is the mint-time snapshot. - models/api_token.js: new ApiToken model (prx_<id>_<secret> format; id is the lookup key, secret bcrypt-hashed + isPrivate, shown once). add()/rotate()/ authenticate(); optional expires_at; best-effort last_used_on; groups snapshot. No _ttl (persists). Deliberately NOT wrapped in ModelPs (so the last_used_on write on the auth path doesn't spam the socket). - routes/api_token.js: self-service CRUD (list/get/update/delete/rotate), owner-scoped (created_by === reqUsername(req), 403 otherwise). - middleware/auth.js + models/auth.js: accept `Authorization: Bearer prx_...` (precedence over the auth-token session header). Builds a synthetic req.token that satisfies the only three req.token reads (auth.js .user/.groupsArray, authz.js reqUsername .created_by) so the authz layer works unchanged. checkApiToken collapses every failure to one generic 401 (no leak). - views/api_tokens.ejs + routes/render.js (GET /api-tokens): self-service page (forceLogin, no admin gate) — create (token shown once), rotate, revoke. - views/top.ejs: "API Tokens" nav entry visible to all logged-in users. - public/js/app.js: app.apiToken client module. - DEPLOYMENT.md + docs/docker.md: API tokens section. Co-authored-by: Claude <noreply@anthropic.com>
34 lines
1.4 KiB
JavaScript
34 lines
1.4 KiB
JavaScript
'use strict';
|
|
|
|
const router = require('express').Router();
|
|
const conf = require('@simpleworkjs/conf');
|
|
const middleware = require('../middleware/auth');
|
|
const authz = require('../middleware/authz');
|
|
|
|
// API routes for authentication.
|
|
router.use('/auth', require('./auth'));
|
|
|
|
// API routes for working with users. All endpoints need to be have valid user.
|
|
// User management is admin-only; the router allows self-service exceptions
|
|
// (GET /me, PUT /password) before its own admin gate.
|
|
router.use('/user', middleware.auth, require('./user'));
|
|
|
|
// API routes for working with hosts. All endpoints need to be have valid user.
|
|
// Per-domain authorization is enforced inside the host router.
|
|
router.use('/host', middleware.auth, require('./host'));
|
|
|
|
router.use('/dns', middleware.auth, require('./dns'));
|
|
|
|
// API routes for working with hosts. All endpoints need to be have valid user.
|
|
router.use('/cert', middleware.auth, require('./cert'));
|
|
|
|
// Permission management (who can manage which domains) is global-admin-only.
|
|
router.use('/permission', middleware.auth, authz.requireAdmin, require('./permission'));
|
|
|
|
// Local group management is global-admin-only.
|
|
router.use('/group', middleware.auth, authz.requireAdmin, require('./group'));
|
|
|
|
// Self-service API tokens (PATs) — owner-scoped, no admin gate required.
|
|
router.use('/api-token', middleware.auth, require('./api_token'));
|
|
|
|
module.exports = router; |