feat: actionable metrics, LDAP log parsing, UI updates

nodejs/routes/api_directory_admin.js

@@ -0,0 +1,227 @@
+'use strict';
+const router = require('express').Router();
+const permission = require('../utils/permission');
+const { Resource, ResourceEdge, ResourceGroup } = require('../models/resource');
+const { Group } = require('../models/group_ldap');
+
+// Require the admin group
+router.use(async (req, res, next) => {
+  try {
+    await permission.byGroup(req.user, ['app_sso_directory_admin', 'app_sso_admin']);
+    next();
+  } catch(err) {
+    next(err);
+  }
+});
+
+// --- Resources ---
+router.get('/resources', async (req, res, next) => {
+  try {
+    const resources = await Resource.list();
+    res.json({ results: resources });
+  } catch (err) { next(err); }
+});
+
+router.post('/resources', async (req, res, next) => {
+  try {
+    if (!req.body.hostId && req.body.parentSlug) {
+      const parents = await Resource.list({ where: { slug: req.body.parentSlug } });
+      if (parents.length > 0) req.body.hostId = parents[0].id;
+    }
+    
+    if (req.body.kind === 'host' && !req.body.hostId) {
+      return res.status(400).json({ error: 'Hosts must have a parent Site or Host' });
+    }
+    if (req.body.kind === 'service' && !req.body.hostId) {
+      return res.status(400).json({ error: 'Services must have a parent Host' });
+    }
+    if (req.body.kind === 'oauth' && !req.body.hostId) {
+      return res.status(400).json({ error: 'OAuth Integrations must have a parent Service' });
+    }
+    
+    req.body.owner = req.body.owner || req.user.uid;
+    
+    let r;
+    if (req.body.kind === 'oauth') {
+      const { OAuthClient } = require('../models/oauth_client');
+      // Pass created_by explicitly for the wrapper
+      req.body.created_by = req.body.owner;
+      // In the UI we might pass slug, but OAuthClient wrapper expects name
+      r = await OAuthClient.add(req.body);
+    } else {
+      r = await Resource.create(req.body);
+    }
+    
+    if ((r.kind === 'host' || r.kind === 'service' || r.kind === 'oauth') && req.body.hostId) {
+      await ResourceEdge.create({ parentId: req.body.hostId, childId: r.id, relation: r.kind === 'oauth' ? 'oauth' : 'hosts' });
+    }
+    
+    if (r.kind === 'host' || r.kind === 'service') {
+      const createGroup = async (suffix, accessLevel) => {
+        const cn = `${r.slug}_${suffix}`;
+        try {
+          await Group.add({
+            name: cn,
+            owner: req.user.dn,
+            description: `${suffix === 'admin' ? 'Admin' : 'Access'} group for ${r.name}`
+          });
+        } catch (err) {
+          if (err.name !== 'EntryAlreadyExistsError' && err.code !== 68) {
+            console.error(`Failed to create LDAP group ${cn}:`, err);
+          }
+        }
+        try {
+          await ResourceGroup.create({ resourceId: r.id, groupCn: cn, accessLevel });
+        } catch(err) { /* ignore duplicate links */ }
+      };
+      await createGroup('access', 'member');
+      await createGroup('admin', 'owner');
+    }
+    
+    res.json({ results: r });
+  } catch (err) {
+    if (err.name === 'SequelizeUniqueConstraintError') {
+      return res.status(400).json({ error: 'A resource with this slug already exists.' });
+    }
+    if (err.name === 'SequelizeValidationError') {
+      return res.status(400).json({ error: err.message });
+    }
+    next(err);
+  }
+});
+
+router.put('/resources/:id', async (req, res, next) => {
+  try {
+    let r;
+    if (req.body.kind === 'oauth') {
+        const { OAuthClient } = require('../models/oauth_client');
+        r = await OAuthClient.get(req.params.id);
+    } else {
+        r = await Resource.get(req.params.id);
+    }
+    if (!r) return res.status(404).json({ error: 'Not found' });
+    
+    if (req.body.kind === 'host' && !req.body.hostId) {
+      return res.status(400).json({ error: 'Hosts must have a parent Site or Host' });
+    }
+    if (req.body.kind === 'service' && !req.body.hostId) {
+      return res.status(400).json({ error: 'Services must have a parent Host' });
+    }
+    if (req.body.kind === 'oauth' && !req.body.hostId) {
+      return res.status(400).json({ error: 'OAuth Integrations must have a parent Service' });
+    }
+    
+    let updated;
+    if (req.body.kind === 'oauth') {
+        updated = await r.update(req.body);
+    } else {
+        updated = await r.update(req.body);
+    }
+    
+    if ((updated.kind === 'host' || updated.kind === 'service' || updated.kind === 'oauth') && req.body.hostId !== undefined) {
+      const existingEdges = await ResourceEdge.list({ where: { childId: r.id } });
+      for (const e of existingEdges) {
+        if (e.relation === 'hosts' || e.relation === 'oauth') await e.delete();
+      }
+      if (req.body.hostId) {
+        await ResourceEdge.create({ parentId: req.body.hostId, childId: r.id, relation: updated.kind === 'oauth' ? 'oauth' : 'hosts' });
+      }
+    }
+    
+    res.json({ results: updated });
+  } catch (err) {
+    next(err);
+  }
+});
+
+router.post('/resources/:id/rotate-secret', async (req, res, next) => {
+    try {
+        const { OAuthClient } = require('../models/oauth_client');
+        const client = await OAuthClient.get(req.params.id);
+        const secret = await client.rotateSecret();
+        res.json({ secret });
+    } catch (err) {
+        next(err);
+    }
+});
+
+router.delete('/resources/:id', async (req, res, next) => {
+  try {
+    const r = await Resource.get(req.params.id);
+    if (!r) return res.status(404).json({ error: 'Not found' });
+    await r.delete();
+    // Also delete edges and groups involving this resource
+    const edgesParent = await ResourceEdge.list({ where: { parentId: req.params.id } });
+    const edgesChild = await ResourceEdge.list({ where: { childId: req.params.id } });
+    const groups = await ResourceGroup.list({ where: { resourceId: req.params.id } });
+    for (const e of [...edgesParent, ...edgesChild]) await e.delete();
+    for (const g of groups) await g.delete();
+    res.json({ results: true });
+  } catch (err) { next(err); }
+});
+
+// --- Edges ---
+router.get('/edges', async (req, res, next) => {
+  try {
+    const edges = await ResourceEdge.list();
+    res.json({ results: edges });
+  } catch (err) { next(err); }
+});
+
+router.post('/edges', async (req, res, next) => {
+  try {
+    const edge = await ResourceEdge.create(req.body);
+    res.json({ results: edge });
+  } catch (err) { next(err); }
+});
+
+router.delete('/edges/:id', async (req, res, next) => {
+  try {
+    const edge = await ResourceEdge.get(req.params.id);
+    if (!edge) return res.status(404).json({ error: 'Not found' });
+    await edge.delete();
+    res.json({ results: true });
+  } catch (err) { next(err); }
+});
+
+// --- Groups ---
+router.get('/groups', async (req, res, next) => {
+  try {
+    const groups = await ResourceGroup.list();
+    res.json({ results: groups });
+  } catch (err) { next(err); }
+});
+
+router.post('/groups', async (req, res, next) => {
+  try {
+    const g = await ResourceGroup.create(req.body);
+    res.json({ results: g });
+  } catch (err) { next(err); }
+});
+
+router.delete('/groups/:id', async (req, res, next) => {
+  try {
+    const g = await ResourceGroup.get(req.params.id);
+    if (!g) return res.status(404).json({ error: 'Not found' });
+    await g.delete();
+    res.json({ results: true });
+  } catch (err) { next(err); }
+});
+
+router.get('/audit-logs', async (req, res, next) => {
+  try {
+    const fs = require('fs');
+    const { execSync } = require('child_process');
+    let ldapLogs = '';
+    let oauthLogs = '';
+    let auditLogs = '';
+    
+    try { ldapLogs = execSync('tail -n 100 /var/lib/ldap/slapd.log 2>/dev/null').toString(); } catch(e){}
+    try { oauthLogs = execSync('tail -n 100 /var/lib/ldap/oauth.log 2>/dev/null').toString(); } catch(e){}
+    try { auditLogs = execSync('tail -n 100 /var/lib/ldap/auditlog.ldif 2>/dev/null').toString(); } catch(e){}
+    
+    res.json({ results: { ldap: ldapLogs, oauth: oauthLogs, audit: auditLogs } });
+  } catch (err) { next(err); }
+});
+
+module.exports = router;

nodejs/routes/api_discovery.js

@@ -0,0 +1,36 @@
+'use strict';
+
+const router = require('express').Router();
+const { Resource, ResourceGroup } = require('../models/resource');
+
+// GET /api/discovery/me
+// Returns the list of resources the current user has access to.
+router.get('/me', async (req, res, next) => {
+  try {
+    const userGroups = req.user.groups || []; // array of LDAP group CNs
+    const accessibleResourceIds = new Set();
+    
+    if (req.user.isMachine) {
+        // Machines only have access to themselves by default
+        accessibleResourceIds.add(req.resourceId);
+    } else {
+        // End users get access via groups
+        const allGroups = await ResourceGroup.list();
+        for (const rg of allGroups) {
+            if (userGroups.includes(rg.groupCn)) {
+                accessibleResourceIds.add(rg.resourceId);
+            }
+        }
+    }
+    
+    // Fetch all resources and filter
+    const allResources = await Resource.list();
+    const accessible = allResources.filter(r => accessibleResourceIds.has(r.id) || r.metadata?.isPublic);
+    
+    res.json({ results: accessible });
+  } catch (err) {
+    next(err);
+  }
+});
+
+module.exports = router;

nodejs/routes/api_metrics.js

@@ -0,0 +1,44 @@
+'use strict';
+const router = require('express').Router();
+const permission = require('../utils/permission');
+const metrics = require('../utils/metrics');
+
+// /api/metrics/executive
+router.get('/executive', async (req, res, next) => {
+    try {
+        await permission.byGroup(req.user, ['app_sso_admin']);
+        
+        const topIps = await metrics.getTopN('metrics:failed_ips', 7, 5);
+        const topUsers = await metrics.getTopN('metrics:failed_users', 7, 5);
+        const topServices = await metrics.getTopN('metrics:service_usage', 7, 5);
+        
+        res.json({ results: { ips: topIps, users: topUsers, services: topServices } });
+    } catch(e) {
+        next(e);
+    }
+});
+
+// /api/metrics/user/:uid
+router.get('/user/:uid', async (req, res, next) => {
+    try {
+        // Can only view if admin or self
+        if (req.user.uid !== req.params.uid) {
+            await permission.byGroup(req.user, ['app_sso_admin']);
+        }
+        
+        // Failed logins for user is hard if we didn't track it by user, but wait, we did! metrics:failed_users:YYYY-MM-DD
+        // However, we didn't track failed IPs per user. We tracked failed_users as a sorted set.
+        // To get the user's failures, we just query their score from the union.
+        
+        // Wait, for services we have user_service_usage:<uid>:<date>. No, in metrics.js I wrote:
+        // `metrics:user_service_usage:${username}:${date}`
+        
+        const topServices = await metrics.getTopN('metrics:user_service_usage', 7, 5, req.params.uid);
+        
+        res.json({ results: { services: topServices } });
+    } catch(e) {
+        next(e);
+    }
+});
+
+module.exports = router;

nodejs/routes/auth.js

@@ -13,6 +13,7 @@ const middleware = require('../middleware/auth');
 const rateLimit = require('../middleware/rate_limit');
 const permission = require('../utils/permission');
 const conf = require('@simpleworkjs/conf');
+const metrics = require('../utils/metrics');
 
 async function findUserByLogin(login) {
 	try {
@@ -37,12 +38,16 @@ router.get('/username-suggestions', async function(req, res, next) {
 router.post('/login', rateLimit.login, async function(req, res, next){
 	try{
 		let auth = await Auth.login(req.body);
+		metrics.recordServiceUsage('SSO Web UI', req.body.uid);
 		return res.json({
 			login: true,
 			token: auth.token.token,
 			message:`${req.body.uid} logged in!`,
 		});
 	}catch(error){
+		if (error.name === 'LDAPLoginFailed' || error.status === 401 || error.name === 'UserNotFound') {
+			metrics.recordFailedLogin(req.ip, req.body.uid);
+		}
 		next(error);
 	}
 });

nodejs/routes/autoRouter.js

@@ -0,0 +1,42 @@
+const express = require('express');
+
+// Parses arguments according to the exposed method config.
+// Extended to support { from: 'user' } which injects `req.user.dn` (LDAP integration).
+function extractArgs(req, cfg) {
+  const args = cfg.args;
+  if (!args) return [];
+  if (args.from === 'user') return [req.user.dn];
+  
+  const source = args.from === 'params' ? req.params
+    : args.from === 'query' ? req.query
+      : req.body;
+      
+  if (Array.isArray(args.names)) return args.names.map(name => source[name]);
+  return [source || {}];
+}
+
+// A mini-auto-router that reads `static exposedMethods` from a @simpleworkjs/orm Model
+// and maps them directly into Express endpoints.
+function autoRouter(Model) {
+  const router = express.Router();
+
+  if (Model.getExposedMethods) {
+    for (const cfg of Model.getExposedMethods()) {
+      router[cfg.verb](cfg.routePath, async function(req, res, next) {
+        try {
+          // In a full implementation, we'd load the instance if cfg.kind === 'instance'.
+          // For now, our methods are all static class methods.
+          const target = Model;
+          const result = await target[cfg.method](...extractArgs(req, cfg));
+          res.json(result);
+        } catch (error) {
+          next(error);
+        }
+      });
+    }
+  }
+  
+  return router;
+}
+
+module.exports = autoRouter;

nodejs/routes/discovery.js

@@ -0,0 +1,4 @@
+const autoRouter = require('./autoRouter');
+const { Resource } = require('../models/resource');
+
+module.exports = autoRouter(Resource);

nodejs/routes/index.js

@@ -55,17 +55,20 @@ router.get('/tos', async function(req, res, next) {
 
 // Admin dashboard (stats + recent/inactive users) and Notifications
 // (broadcast + history) merged into one page.
-router.get('/dashboard', function(req, res) {
-  res.render('dashboard', {...values});
+router.get('/executive', function(req, res) {
+  res.render('executive', {...values});
 });
 
-router.get('/admin', (req, res) => res.redirect(301, '/dashboard'));
-router.get('/notifications', (req, res) => res.redirect(301, '/dashboard'));
+router.get('/admin', (req, res) => res.redirect(301, '/executive'));
+router.get('/notifications', (req, res) => res.redirect(301, '/executive'));
+router.get('/dashboard', (req, res) => res.redirect(301, '/executive'));
 
-router.get('/invites', function(req, res) {
-  res.render('invites', {...values});
+router.get('/directory', function(req, res) {
+  res.render('directory', {...values});
 });
 
+// Route removed since it's now in directory
+
 router.get('/onboarding', async function(req, res, next) {
   try {
     const tos = await Tos.getCurrent();
@@ -76,6 +79,10 @@ router.get('/onboarding', async function(req, res, next) {
 });
 
 router.get('/', async function(req, res, next) {
+  res.render('landing', {...values});
+});
+
+router.get('/profile', async function(req, res, next) {
   res.render('profile', {...values});
 });
 
@@ -145,44 +152,7 @@ router.get('/token', function(req, res, next) {
   res.render('token', {...values});
 });
 
-router.get('/sites', async function(req, res, next) {
-  const net = require('net');
-  const url = require('url');
-  
-  const myId = process.env.LDAP_SERVER_ID || 'Standalone';
-  const hostsStr = process.env.LDAP_REPLICATION_HOSTS || '';
-  const hosts = hostsStr.split(' ').filter(h => h);
-  
-  const sites = await Promise.all(hosts.map(hostUrl => {
-      return new Promise((resolve) => {
-          try {
-              const u = new url.URL(hostUrl);
-              const port = u.port || (u.protocol === 'ldaps:' ? 636 : 389);
-              const hostname = u.hostname;
-              const socket = new net.Socket();
-              socket.setTimeout(2000);
-              
-              socket.on('connect', () => {
-                  socket.destroy();
-                  resolve({ url: hostUrl, status: 'Online' });
-              });
-              socket.on('timeout', () => {
-                  socket.destroy();
-                  resolve({ url: hostUrl, status: 'Offline (Timeout)' });
-              });
-              socket.on('error', (err) => {
-                  socket.destroy();
-                  resolve({ url: hostUrl, status: 'Offline (' + err.code + ')' });
-              });
-              socket.connect(port, hostname);
-          } catch (e) {
-              resolve({ url: hostUrl, status: 'Invalid URL' });
-          }
-      });
-  }));
-  
-  res.render('sites', { ...values, myId, sites });
-});
+
 
             
 router.get('/login/resetpassword/:token', async function(req, res, next){

nodejs/routes/oauth_client.js

@@ -1,124 +0,0 @@
-'use strict';
-
-const router = require('express').Router();
-const { OAuthClient } = require('../models/oauth_client');
-const permission = require('../utils/permission');
-
-const ADMIN_GROUP = 'app_sso_oauth_admin';
-
-router.get('/', async function(req, res, next) {
-	try {
-		await permission.byGroup(req.user, [ADMIN_GROUP]);
-		return res.json({ results: await OAuthClient.listDetail() });
-	} catch(error) {
-		next(error);
-	}
-});
-
-router.post('/', async function(req, res, next) {
-	try {
-		await permission.byGroup(req.user, [ADMIN_GROUP]);
-
-		req.body.created_by = req.user.uid;
-
-		// Parse redirect_uris if sent as newline-separated string from the form
-		if (typeof req.body.redirect_uris === 'string') {
-			req.body.redirect_uris = req.body.redirect_uris.split('\n').map(s => s.trim()).filter(Boolean);
-		}
-		// Parse scopes if sent as space-separated string
-		if (typeof req.body.scopes === 'string') {
-			req.body.scopes = req.body.scopes.split(' ').map(s => s.trim()).filter(Boolean);
-		}
-		// Parse allowed_groups if sent as newline-separated string
-		if (typeof req.body.allowed_groups === 'string') {
-			req.body.allowed_groups = req.body.allowed_groups.split('\n').map(s => s.trim()).filter(Boolean);
-		}
-		// jQuery serializeObject sends nested fields as "token_lifetime[access_token]"
-		if (req.body['token_lifetime[access_token]'] || req.body['token_lifetime[refresh_token]']) {
-			req.body.token_lifetime = {
-				access_token: Number(req.body['token_lifetime[access_token]']) || 3600,
-				refresh_token: Number(req.body['token_lifetime[refresh_token]']) || 2592000,
-			};
-			delete req.body['token_lifetime[access_token]'];
-			delete req.body['token_lifetime[refresh_token]'];
-		}
-
-		const client = await OAuthClient.add(req.body);
-
-		return res.json({
-			results: client,
-			client_secret: client._raw_secret,
-			message: `OAuth client '${client.name}' created. Save the client secret — it will not be shown again.`,
-		});
-	} catch(error) {
-		next(error);
-	}
-});
-
-router.get('/:client_id', async function(req, res, next) {
-	try {
-		await permission.byGroup(req.user, [ADMIN_GROUP]);
-		return res.json({ results: await OAuthClient.get(req.params.client_id) });
-	} catch(error) {
-		next(error);
-	}
-});
-
-router.put('/:client_id', async function(req, res, next) {
-	try {
-		await permission.byGroup(req.user, [ADMIN_GROUP]);
-
-		const client = await OAuthClient.get(req.params.client_id);
-
-		if (typeof req.body.redirect_uris === 'string') {
-			req.body.redirect_uris = req.body.redirect_uris.split('\n').map(s => s.trim()).filter(Boolean);
-		}
-		if (typeof req.body.scopes === 'string') {
-			req.body.scopes = req.body.scopes.split(' ').map(s => s.trim()).filter(Boolean);
-		}
-		if (typeof req.body.allowed_groups === 'string') {
-			req.body.allowed_groups = req.body.allowed_groups.split('\n').map(s => s.trim()).filter(Boolean);
-		}
-
-		return res.json({
-			results: await client.update(req.body),
-			message: `OAuth client '${client.name}' updated.`,
-		});
-	} catch(error) {
-		next(error);
-	}
-});
-
-router.delete('/:client_id', async function(req, res, next) {
-	try {
-		await permission.byGroup(req.user, [ADMIN_GROUP]);
-
-		const client = await OAuthClient.get(req.params.client_id);
-		await client.remove();
-
-		return res.json({
-			client_id: req.params.client_id,
-			message: `OAuth client '${client.name}' deleted.`,
-		});
-	} catch(error) {
-		next(error);
-	}
-});
-
-router.post('/:client_id/rotate', async function(req, res, next) {
-	try {
-		await permission.byGroup(req.user, [ADMIN_GROUP]);
-
-		const client = await OAuthClient.get(req.params.client_id);
-		const new_secret = await client.rotateSecret();
-
-		return res.json({
-			client_secret: new_secret,
-			message: `Client secret rotated for '${client.name}'. Save it — it will not be shown again.`,
-		});
-	} catch(error) {
-		next(error);
-	}
-});
-
-module.exports = router;

nodejs/routes/user.js

@@ -231,7 +231,7 @@ router.get('/invite', async function(req, res, next){
 	try{
 		await permission.byGroup(req.user, ['app_sso_admin', 'app_sso_invite']);
 		const isAdmin = await permission.byGroup(req.user, ['app_sso_admin']).then(() => true).catch(() => false);
-		const all = await InviteToken.listDetail();
+		const all = await InviteToken.list();
 		const visible = isAdmin ? all : all.filter(t => t.created_by === req.user.uid);
 		const results = visible.map(t => ({ token: t.token, ...t }));
 		return res.json({ results });