feat(release): v1.14.0 discovery and conf pages

nodejs/routes/api_conf.js

@@ -0,0 +1,33 @@
+const router = require('express').Router();
+const confManager = require('../utils/conf_manager');
+const permission = require('../utils/permission');
+const conf = require('@simpleworkjs/conf');
+
+router.use(async (req, res, next) => {
+  try {
+    await permission.byGroup(req.user, ['app_sso_admin']);
+    next();
+  } catch(err) {
+    next(err);
+  }
+});
+
+router.get('/', async (req, res) => {
+  const editable = {
+    smtp: conf.smtp || {},
+    discovery: conf.discovery || {},
+    oauth: conf.oauth || {}
+  };
+  res.json(editable);
+});
+
+router.post('/', async (req, res, next) => {
+  try {
+    await confManager.setVaultConf(req.body);
+    res.json({ success: true });
+  } catch(err) {
+    next(err);
+  }
+});
+
+module.exports = router;

nodejs/routes/api_directory_admin.js

@@ -42,7 +42,12 @@ router.use(async (req, res, next) => {
 // --- Resources ---
 router.get('/resources', async (req, res, next) => {
   try {
-    const resources = await Resource.list();
+    let resources = await Resource.list();
+    resources = resources.filter(r => {
+      const isAuto = r.metadata?.discovery_sources?.length > 0 && !r.metadata.discovery_sources.includes('manual');
+      const isManaged = r.metadata?.managed === true;
+      return !isAuto || isManaged;
+    });
     // Even admins never receive secret metadata (e.g. client_secret_hash) over
     // the wire; projectResources strips it unconditionally.
     res.json({ results: projectResources(resources, { fullMetadata: true }) });

nodejs/routes/discovery.js

@@ -83,7 +83,12 @@ router.get('/me', async (req, res, next) => {
 				for (const rg of rgs) ids.add(rg.resourceId);
 			}
 			const all = await Resource.list();
-			accessible = all.filter(r => ids.has(r.id) || (r.metadata && r.metadata.isPublic));
+			accessible = all.filter(r => {
+				const isAuto = r.metadata?.discovery_sources?.length > 0 && !r.metadata.discovery_sources.includes('manual');
+				const isManaged = r.metadata?.managed === true;
+				if (isAuto && !isManaged) return false;
+				return ids.has(r.id) || (r.metadata && r.metadata.isPublic);
+			});
 		}
 		// resolvedAddress is the whole point of /me ("how do I reach it") and a
 		// service inherits it from its host, so it must be computed here rather
@@ -93,4 +98,61 @@ router.get('/me', async (req, res, next) => {
 	} catch (err) { next(err); }
 });
 
+// POST /api/discovery/sync
+// Used by external agents (e.g. ldap-client) to push discovery data.
+router.post('/sync', async (req, res, next) => {
+	try {
+		const { DiscoveryReconciler } = require('../services/discovery_reconciler');
+		// Assuming the caller provides a source name and payload
+		const source = req.body.source || 'agent';
+		await DiscoveryReconciler.reconcile(source, req.body.payload || req.body);
+		res.json(envelope({ success: true }));
+	} catch (err) { next(err); }
+});
+
+// POST /api/discovery/promote/:slug
+// Promotes an unmanaged device to managed by creating its LDAP groups.
+router.post('/promote/:slug', async (req, res, next) => {
+	try {
+		const resource = await Resource.getBySlug(req.params.slug);
+		if (!resource) return res.status(404).json(envelope({ error: 'Not found' }));
+		
+		const { Group } = require('../models/group_ldap');
+		
+		const accessGroup = `${resource.slug}_access`;
+		const adminGroup = `${resource.slug}_admin`;
+		
+		// Create groups if they don't exist
+		try { await Group.get(accessGroup); } catch (e) {
+			if (e.status === 404) await Group.add({ name: accessGroup, description: `Access to ${resource.name}`, owner: req.user.dn });
+			else throw e;
+		}
+		try { await Group.get(adminGroup); } catch (e) {
+			if (e.status === 404) await Group.add({ name: adminGroup, description: `Admin access to ${resource.name}`, owner: req.user.dn });
+			else throw e;
+		}
+		
+		// Link them
+		const crypto = require('crypto');
+		await ResourceGroup.create({
+			id: crypto.randomUUID(),
+			resourceId: resource.id,
+			groupCn: accessGroup,
+			accessLevel: 'user'
+		});
+		await ResourceGroup.create({
+			id: crypto.randomUUID(),
+			resourceId: resource.id,
+			groupCn: adminGroup,
+			accessLevel: 'admin'
+		});
+		
+		const meta = resource.metadata || {};
+		meta.managed = true;
+		await resource.update({ metadata: meta });
+		
+		res.json(envelope({ success: true, groups: [accessGroup, adminGroup] }));
+	} catch (err) { next(err); }
+});
+
 module.exports = router;

nodejs/routes/docs.js

@@ -34,6 +34,8 @@ const DOCS = {
 	'oauth-apps':    {title: 'Connecting Apps (SSO)',   file: path.join(__dirname, '../../docs/concepts-oauth-apps.md')},
 	'api-tokens':    {title: 'API Tokens',              file: path.join(__dirname, '../../docs/concepts-api-tokens.md')},
 	directory:       {title: 'Directory & Inventory',   file: path.join(__dirname, '../../docs/directory.md')},
+	plugins:         {title: 'Plugins & Scheduler',     file: path.join(__dirname, '../../docs/plugins.md')},
+	vault:           {title: 'Vault Secrets',           file: path.join(__dirname, '../../docs/vault.md')},
 
 	overview:        {title: 'Overview',        file: path.join(__dirname, '../../README.md')},
 	changelog:       {title: 'Changelog',       file: path.join(__dirname, '../../CHANGELOG.md')},

nodejs/routes/index.js

@@ -68,6 +68,18 @@ router.get('/directory', function(req, res) {
   res.render('directory', {...values});
 });
 
+router.get('/discovery', function(req, res, next) {
+  res.redirect('/directory');
+});
+
+router.get('/plugins',  function(req, res, next) {
+  res.redirect('/directory');
+});
+
+router.get('/vault',  function(req, res, next) {
+  res.render('vaultwarden', {...values});
+});
+
 // Linkable deep-link to a single resource's modal, e.g. from the resource
 // modal's app.modal `url` option. Mirrors /users/:uid below: no server-side
 // use of :slug at all -- the client reads location.pathname itself and opens
@@ -99,6 +111,10 @@ router.get('/users', async function(req, res, next) {
   res.render('users', {...values});
 });
 
+router.get('/conf', async function(req, res, next) {
+  res.render('conf', {...values});
+});
+
 router.get('/login', async function(req, res, next) {
   res.render('login', {...values, redirect: req.query.redirect});
 });

nodejs/routes/plugins.js

@@ -0,0 +1,59 @@
+const router = require('express').Router();
+const conf = require('@simpleworkjs/conf');
+const permission = require('../utils/permission');
+
+router.use(async (req, res, next) => {
+  try {
+    await permission.byGroup(req.user, ['app_sso_directory_admin', 'app_sso_admin']);
+    next();
+  } catch(err) {
+    next(err);
+  }
+});
+
+const Redis = require('ioredis');
+const connection = new Redis(process.env.REDIS_URL || 'redis://127.0.0.1:6379', { maxRetriesPerRequest: null });
+const { initScheduler } = require('../services/scheduler');
+
+router.get('/', async (req, res) => {
+  const plugins = conf.discovery && conf.discovery.plugins ? conf.discovery.plugins : {};
+  let overrides = {};
+  try {
+    const data = await connection.hgetall('discovery_plugins');
+    for (const [k, v] of Object.entries(data)) {
+      overrides[k] = JSON.parse(v);
+    }
+  } catch(e) {}
+  
+  // Mask secrets before sending
+  const masked = JSON.parse(JSON.stringify(plugins));
+  for (const name in masked) {
+    masked[name] = { ...masked[name], ...(overrides[name] || {}) };
+    if (masked[name].tokenSecret) masked[name].tokenSecret = '********';
+    if (masked[name].password) masked[name].password = '********';
+  }
+  res.json({ results: masked });
+});
+
+router.put('/:name', async (req, res) => {
+  const name = req.params.name;
+  const updates = req.body;
+  
+  let current = {};
+  try {
+    const data = await connection.hget('discovery_plugins', name);
+    if (data) current = JSON.parse(data);
+  } catch(e) {}
+  
+  if (updates.cron !== undefined) current.cron = updates.cron;
+  if (updates.enabled !== undefined) current.enabled = updates.enabled === true || updates.enabled === 'true';
+  
+  await connection.hset('discovery_plugins', name, JSON.stringify(current));
+  
+  // Re-init scheduler to apply changes
+  await initScheduler(conf.discovery).catch(console.error);
+  
+  res.json({ success: true, message: 'Plugin updated' });
+});
+
+module.exports = router;

nodejs/routes/webhook.js

@@ -0,0 +1,36 @@
+const router = require('express').Router();
+const { Webhook } = require('../models/webhook');
+const crypto = require('crypto');
+
+// GET /api/webhooks
+router.get('/', async (req, res, next) => {
+  try {
+    const hooks = await Webhook.list();
+    res.json({ results: hooks });
+  } catch (err) { next(err); }
+});
+
+// POST /api/webhooks
+router.post('/', async (req, res, next) => {
+  try {
+    const { name, url, events, secret } = req.body;
+    const hook = await Webhook.create({
+      id: crypto.randomUUID(),
+      name, url, events, secret,
+      created_on: Math.floor(Date.now() / 1000)
+    });
+    res.json({ results: hook });
+  } catch (err) { next(err); }
+});
+
+// DELETE /api/webhooks/:id
+router.delete('/:id', async (req, res, next) => {
+  try {
+    const hook = await Webhook.get(req.params.id);
+    if (!hook) return res.status(404).json({ error: 'Not found' });
+    await hook.delete();
+    res.json({ success: true });
+  } catch (err) { next(err); }
+});
+
+module.exports = router;