wmantly
a9a48c3445
Personal access tokens so scripts/CI can call the management API without an OIDC browser session. Each logged-in user mints their own token; it authenticates as the creator (groups snapshotted at mint, mirroring the proxy's browser AuthToken), and the existing authz layer (Permission.effectiveFor / roles.resolveEffective) applies unchanged. Local groups and owned-domain rights are recomputed live; only SSO/LDAP group membership is the mint-time snapshot. - models/api_token.js: new ApiToken model (prx_<id>_<secret> format; id is the lookup key, secret bcrypt-hashed + isPrivate, shown once). add()/rotate()/ authenticate(); optional expires_at; best-effort last_used_on; groups snapshot. No _ttl (persists). Deliberately NOT wrapped in ModelPs (so the last_used_on write on the auth path doesn't spam the socket). - routes/api_token.js: self-service CRUD (list/get/update/delete/rotate), owner-scoped (created_by === reqUsername(req), 403 otherwise). - middleware/auth.js + models/auth.js: accept `Authorization: Bearer prx_...` (precedence over the auth-token session header). Builds a synthetic req.token that satisfies the only three req.token reads (auth.js .user/.groupsArray, authz.js reqUsername .created_by) so the authz layer works unchanged. checkApiToken collapses every failure to one generic 401 (no leak). - views/api_tokens.ejs + routes/render.js (GET /api-tokens): self-service page (forceLogin, no admin gate) — create (token shown once), rotate, revoke. - views/top.ejs: "API Tokens" nav entry visible to all logged-in users. - public/js/app.js: app.apiToken client module. - DEPLOYMENT.md + docs/docker.md: API tokens section. Co-authored-by: Claude <noreply@anthropic.com>
94 lines
1.8 KiB
JavaScript
Executable File
94 lines
1.8 KiB
JavaScript
Executable File
app.host = (function(app){
|
|
function list(callack){
|
|
app.api.get('host/?detail=true', function(error, data){
|
|
callack(error, data.hosts)
|
|
});
|
|
}
|
|
|
|
function get(host, callack){
|
|
app.api.get('host/' + host, function(error, data){
|
|
callack(error, data)
|
|
});
|
|
}
|
|
|
|
function add(args, callack){
|
|
app.api.post('host/', args, function(error, data){
|
|
callack(error, data);
|
|
});
|
|
}
|
|
|
|
function edit(args, callack){
|
|
app.api.put('host/' + args.edit_host, args, function(error, data){
|
|
callack(error, data);
|
|
});
|
|
}
|
|
|
|
function remove(args, callack){
|
|
app.api.delete('host/'+ args.host, function(error, data){
|
|
callack(error, data);
|
|
});
|
|
}
|
|
|
|
function getCert(args, callack){
|
|
app.api.get('cert/'+args.host, function(error, data){
|
|
callack(error, data);
|
|
});
|
|
}
|
|
|
|
function clearCache(callack){
|
|
app.api.delete('host/cache', function(error, data){
|
|
callack(error, data);
|
|
});
|
|
}
|
|
|
|
return {
|
|
getCert,
|
|
list: list,
|
|
get: get,
|
|
add: add,
|
|
edit: edit,
|
|
remove: remove,
|
|
clearCache: clearCache,
|
|
}
|
|
})(app);
|
|
|
|
app.apiToken = (function(app){
|
|
function list(callback){
|
|
app.api.get('api-token/', function(error, data){
|
|
callback(error, data);
|
|
});
|
|
}
|
|
|
|
function get(id, callback){
|
|
app.api.get('api-token/' + id, function(error, data){
|
|
callback(error, data);
|
|
});
|
|
}
|
|
|
|
function add(args, callback){
|
|
app.api.post('api-token/', args, function(error, data){
|
|
callback(error, data);
|
|
});
|
|
}
|
|
|
|
function update(args, callback){
|
|
app.api.put('api-token/' + args.id, args, function(error, data){
|
|
callback(error, data);
|
|
});
|
|
}
|
|
|
|
function remove(args, callback){
|
|
app.api.delete('api-token/' + args.id, function(error, data){
|
|
callback(error, data);
|
|
});
|
|
}
|
|
|
|
function rotate(args, callback){
|
|
app.api.post('api-token/' + args.id + '/rotate', {}, function(error, data){
|
|
callback(error, data);
|
|
});
|
|
}
|
|
|
|
return {list, get, add, update, remove, rotate};
|
|
})(app);
|