sso-manager-node

theta42/sso-manager-node

Fork 0

Commit Graph

Author	SHA1	Message	Date
wmantly	21a56dce50	v1.16.1: fix 401 on /conf and /vault for logged-in admins (#137 ) Both view routes did server-side auth via req.user, but this app's auth-token is a header set by client JS (localStorage), not a cookie — so req.user is undefined on a browser navigation. permission.byGroup(undefined,...) throws status 401, and the middleware.auth gate on /vault threw Auth.errors.login() (401) for the same reason. Both routes now render the shell unconditionally (like /users, /directory) and gate client-side. conf.ejs already called app.auth.forceLogin; vault.ejs now derives isAdmin + personal namespace from /api/user/me after forceLogin instead of server-rendering them. /api/conf and /api/vault still enforce app_sso_admin + OpenBao scope server-side — only the view-route gating moved client-side where the session lives. Also removed a dead duplicate /conf route. Co-authored-by: Claude <noreply@anthropic.com>	2026-08-01 18:42:51 -04:00
wmantly	59d4b65195	v1.16.0: OpenBao as central secrets store + vault broker + UI rework - Boot: bao-conf.init('sso-manager') replaces conf_manager; deep-merges secret/sso-manager/conf over file config (fail-soft). Scoped VAULT_TOKEN (policy sso-broker), never root. - /api/vault reworked: middleware.auth -> scopeGuard -> token-injecting proxy. vault_broker.js mints Redis-cached per-user (user-<uid>) / per-admin (sso-admin) tokens via the sso-broker role; scopeGuard enforces path prefix on top of the OpenBao policy. Client auth-token stripped. - vault UI renamed (vaultwarden.ejs -> vault.ejs), /vault route auth-gated, role-scoped: users see only secret/users/<uid>/, admins get free-form + Apps mint tab (secret/apps/<name>/, token shown once). - api_conf.js writes via bao-conf.set('sso-manager', ...). - Remediation: config/-secrets.js untracked+gitignored, test_plugins.js deleted, proxy-secrets.js.example placeholder added. Secrets remain in git history; provider-side rotation is the real fix. Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-01 12:36:08 -04:00

Author

SHA1

Message

Date

wmantly

21a56dce50

v1.16.1: fix 401 on /conf and /vault for logged-in admins (#137 )

Both view routes did server-side auth via req.user, but this app's auth-token is
a header set by client JS (localStorage), not a cookie — so req.user is
undefined on a browser navigation. permission.byGroup(undefined,...) throws
status 401, and the middleware.auth gate on /vault threw Auth.errors.login()
(401) for the same reason.

Both routes now render the shell unconditionally (like /users, /directory) and
gate client-side. conf.ejs already called app.auth.forceLogin; vault.ejs now
derives isAdmin + personal namespace from /api/user/me after forceLogin
instead of server-rendering them. /api/conf and /api/vault still enforce
app_sso_admin + OpenBao scope server-side — only the view-route gating moved
client-side where the session lives. Also removed a dead duplicate /conf route.

Co-authored-by: Claude <noreply@anthropic.com>

2026-08-01 18:42:51 -04:00

wmantly

59d4b65195

v1.16.0: OpenBao as central secrets store + vault broker + UI rework

- Boot: bao-conf.init('sso-manager') replaces conf_manager; deep-merges
  secret/sso-manager/conf over file config (fail-soft). Scoped VAULT_TOKEN
  (policy sso-broker), never root.
- /api/vault reworked: middleware.auth -> scopeGuard -> token-injecting
  proxy. vault_broker.js mints Redis-cached per-user (user-<uid>) /
  per-admin (sso-admin) tokens via the sso-broker role; scopeGuard enforces
  path prefix on top of the OpenBao policy. Client auth-token stripped.
- vault UI renamed (vaultwarden.ejs -> vault.ejs), /vault route auth-gated,
  role-scoped: users see only secret/users/<uid>/, admins get free-form +
  Apps mint tab (secret/apps/<name>/*, token shown once).
- api_conf.js writes via bao-conf.set('sso-manager', ...).
- Remediation: config/*-secrets.js untracked+gitignored, test_plugins.js
  deleted, proxy-secrets.js.example placeholder added. Secrets remain in
  git history; provider-side rotation is the real fix.

Co-Authored-By: Claude <noreply@anthropic.com>

2026-08-01 12:36:08 -04:00

2 Commits