Merge pull request #106 from theta42/fix/sshpublickey-oauth-parent

Fix sshPublicKey ObjectClassViolationError and blank OAuth parent dropdown

CHANGELOG.md

@@ -4,6 +4,64 @@ All notable changes to this project are documented here. Format loosely
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions
 correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.
 
+## [1.5.1] - 2026-07-27
+
+### Fixed
+- **`PUT /api/user/:uid` 500'd with `ObjectClassViolationError` (LDAP `0x41`) when setting `sshPublicKey`** on any account created before the `ldapPublicKey` auxiliary objectClass was added to new-user creation (e.g. the bootstrap `admin` account). `User.update`'s `sshPublicKey` handling and `User.addSSHkey` (`nodejs/models/user_ldap.js`) now add the `ldapPublicKey` objectClass first (ignoring `TypeOrValueExistsError` if already present), the same pattern already used for `dateOfBirth`/`theta42Person`.
+- **OAuth Integration parent dropdown was blank.** `populateHostDropdown` in `nodejs/views/directory.ejs` only built options for `kind === 'host'` and `kind === 'service'` — there was no branch for `kind === 'oauth'`, so choosing "OAuth Integration" in the Directory's add-resource modal left the parent-Service picker empty except the placeholder. Added the missing branch.
+
+## [1.5.0] - 2026-07-26
+
+### Changed
+- **Unified the front-end UI shell across the three theta42 apps.** `views/top.ejs`, `views/bottom.ejs` and `public/lib/js/app-base.js` are now byte-identical in sso-manager-node, proxy and jump-host, so the apps look and behave the same and a shell change lands in one edit per repo instead of three divergent ones. Everything that differs between the apps moved into a new `nodejs/utils/ui.js`, exposed to every render as `ui` via `app.locals`: nav items and the groups that may see them, footer repo/license/docs/Terms links, favicon, the profile and post-logout targets, and whether the update banner exists at all.
+- **One nav-gating model everywhere.** `app-base.js` reveals `.group-required-<cn>` elements for each group the current user is in, read from `GET /api/user/me`. sso-manager-node reports LDAP DNs in `memberOf` and the OIDC clients report CNs in `groups`; both normalise to CNs client-side, and the clients' effective-rights `isAdmin` flag is exposed as a synthetic `admin` group — so one gating model covers a group-based provider and boolean-admin clients without either app learning the other's response shape.
+- **`GET /api/user/me` is fetched once per page load and cached** (`app.auth.loadUser`). The nav, per-view `forceLogin` and every group-gated element read that one promise instead of issuing their own request.
+- `app.auth.isLoggedIn` is dual-mode: it returns a Promise **and** invokes an optional node-style callback, so the async and callback call styles both work against one shared `top.ejs`.
+- `app.auth.forceLogin` no longer uses `$.holdReady` (removed in jQuery 4). An unauthenticated user is redirected to `/login?redirect=<path>`; group requirements are still enforced, and `logOut` now only clears the session, leaving the destination to the caller (`ui.logoutRedirect`).
+- Dependency alignment across all three apps: `jquery` `^4.0.0` and `ejs` `^3.1.10`.
+
+### Fixed
+- **`app.api.delete` dropped its callback when called by `formAJAX`.** `formAJAX` always passes the serialized form as the second argument, so a DELETE-method form's callback landed in the data slot and never ran. `delete` now accepts both `(url, callback)` and `(url, data, callback)`.
+- **`app.api.post`/`put` referenced an undefined `callback2`** and threw when handed a non-function callback. Both are now dual-mode Promise/callback.
+- **The login page's "reveal the card once we know you're logged out" branch threw** (`Cannot read properties of null`) whenever the logged-in check answered before the parser reached that element — which it always did without a stored token. It now runs on DOM ready.
+- **`logInRedirect` on the legacy `/login/<path>` form kept only the path.** The OIDC provider routes an unauthenticated authorization request through `/login/oauth/authorize?client_id=…&state=…`; dropping the query there loses the entire authorization request. The suffix form now preserves its query string.
+
+### Fixed (sso-manager-node)
+- `public/lib/js/val.js` shadowed `message` with `let` inside `validateField`, so a custom rule's return value never reached `validateMessage` and the caller always saw the generic length message. Resolved by adopting the shared validator, which also brings the `target`/`hostname` rules and the real password policy (>= 8 chars, and either 12+ or 3 of 4 character classes) to this app.
+- `public/js/app.js` used `$.isFunction`, removed in jQuery 4.
+
+### Added (sso-manager-node)
+- `GET /api/user/me` now also reports `isAdmin` (membership in `app_sso_admin`), the single effective-rights flag the shared UI shell gates the update banner on. Group-level gating still reads `memberOf`.
+
+### Verified
+- Browser-verified against a full theta-env stack (sso-manager + proxy + jump-host): every top-level page renders with a clean console; nav gating is correct for admin and non-admin; `forceLogin`'s onboarding and group gates fire; `val.js` blocks a weak password and accepts a strong one through a real form submit; the DELETE-method forms work; and the OIDC login round trip (authorize with PKCE -> login -> consent -> callback -> token fragment) completes on both OIDC clients.
+
+## [1.4.0] - 2026-07-25
+
+### Security
+- **The directory discovery API leaked OAuth `client_secret_hash` (and any secret-ish metadata key) to every authenticated caller.** `Resource` doesn't override `toJSON`, so the ORM serialized `metadata` wholesale — including the `client_secret_hash` stored on `kind:'oauth'` resources — across `GET /api/discovery/resources`, `/graph`, `/me`, `/resources/:slug`, and the directory-admin `GET /api/directory-admin/resources`. Every discovery read endpoint and the admin list now route through `projectResource`/`projectResources` from `@simpleworkjs/directory-schema`, which unconditionally strips secret keys (anything matching `/secret|password|privatekey/i`, including `client_secret_hash`) and, for non-directory-admins, reduces metadata to a public allowlist. Admins never receive `client_secret_hash` either.
+
+### Fixed
+- **Directory discovery envelope drift.** `routes/discovery.js` (the `autoRouter(Resource)` mounted live at `app.js:87`) returned **bare arrays**, not the `{ results: [...] }` envelope the directory contract specifies — so jump-host's `data.results || []` collapsed every per-group query to `[]` and no user could bridge. Discovery is now served by explicit `/resources`, `/resources/:slug`, `/graph`, `/me` handlers that all return the `{ results }` envelope. The dead `routes/api_discovery.js` (mounted at `app.js:112`, *after* the 404 catcher) and its mount were removed.
+- `GET /api/discovery/resources?group=<cn>` now returns 200 with `{ results: [...] }` instead of 404 (the autoRouter's `search` supported `?group=`, but the route was effectively unreachable for jump-host's call pattern).
+
+### Added
+- Adopted the shared `@simpleworkjs/*` packages published under the simpleworkjs org:
+  - `@simpleworkjs/directory-schema` — the directory contract: the `kind` enum, `Resource`/`ResourceEdge`/`ResourceGroup` field defs, the `{ results }` envelope, the security projection (`projectResource`/`projectResources`/`isDirectoryAdmin`), and the discovery client. `models/resource.js` imports the field defs; the discovery + directory-admin routes use the projection.
+  - `@simpleworkjs/ldap` — `models/user_ldap.js` and `models/group_ldap.js` now take `escapeFilter`/`escapeDN` and `makeClient`/`withClient` from the shared package (via local wrappers that pass `conf`); sso keeps its rich `User.get`/`Group.get`/`User.login`/`User.addSSHkey` (posix/write-side stays app-local). sso's `makeClient` passes no `tlsOptions`, so cert validation is unchanged.
+  - `@simpleworkjs/app-stack` — unified `build_info` (`{buildVersion, buildHash, buildYear}`) and the `static-modules` mounting helper. `utils/build_info.js` and the static-modules loop in `routes/index.js` use the shared helpers.
+- New `tests/discovery.test.js` (jest + supertest, runs under the docker harness): locks in the `{ results }` envelope on `/resources`, `/graph`, `/me`, `/resources/:slug`, the `?group=` 200-regression, and the no-`client_secret_hash`/no-secret-key guarantee for every caller.
+
+### Changed
+- Dependency alignment: `ldapts` `^8.1.2` → `^8.1.8`. The new `@simpleworkjs/*` deps resolve from the npm registry (`^1.0.0`); no `file:`/`link:` entries in the lockfile, so `npm ci` is clean in docker builds.
+- `build_info` export shape changed from `{commit, version}` to `{buildVersion, buildHash, buildYear}` (the shared shape used by all three apps).
+
+## [1.3.2] - 2026-07-23
+
+### Fixed
+- **OAuth client management API returned `client_id: undefined` on every GET.** The ORM's `Model.toJSON()` only serializes schema fields, so the mapped `client_id`/`scopes`/`redirect_uris`/… that `OAuthClient.get()` attaches to the wrapped Resource were stripped from `GET /api/oauth/client` and `GET /api/oauth/client/:id` responses. The theta-env bootstrap (which lists clients and rotates by the returned `client_id`) then called `/api/oauth/client/undefined/rotate` and got a 500, aborting stack bring-up when `proxy-secrets.js` had no usable secret. `OAuthClient.get()` now emits an explicit public JSON shape (and deliberately omits `client_secret_hash`, so the secret hash no longer leaks over the API).
+- `OAuthClient.get()` no longer 500s on an unknown/`undefined` client id: `Resource.get()` returns `null` (it doesn't throw), which was dereferenced as `r.kind`. It now returns a clean 404.
+
 ## [1.3.1] - 2026-07-23
 
 ### Added

directory_spec.md

@@ -1,8 +1,10 @@
 # Home-Lab Directory / Inventory — Design Spec
 
-Status: **Draft / agreed direction** (no code yet)
+Status: **Implemented** (v1.2.1+: model, admin API, UI; v1.3.x: automatic
+registration from theta-env + ldap-client). §9 adds the planned-consumer
+readiness review.
 Owner: wmantly
-Last updated: 2026-07-02
+Last updated: 2026-07-23
 
 ---
 
@@ -220,3 +222,148 @@ Write endpoints (POST/PUT/DELETE) are **out of scope for v1**; population is man
    for auth, SQL for inventory.
 4. **Read-visibility policy:** confirm option (a) vs (b) in §5.
 5. **Service token scope:** Currently `ApiToken` shares the creator's full permissions. A future enhancement could scope tokens specifically to the Directory API.
+
+---
+
+## 9. Planned consumers — data-model & API readiness
+
+Five consumers the directory data should be able to power. None are being
+built yet; this section records what each needs, what already exists, and the
+gaps to close so the model/API never paints us into a corner.
+
+The recurring theme: **the graph model itself (Resource / ResourceEdge /
+ResourceGroup + LDAP groups) is sufficient for all five.** The gaps are
+(a) one new model (access requests), (b) machine-to-machine auth for the read
+API, (c) documented metadata conventions instead of new columns, and
+(d) change detection for the drift/sync consumers.
+
+### 9.1 End-user exploration ("Netflix-style" catalog + request access)
+
+A user browses everything that exists — part advertisement, part
+documentation — sees what they already have, and requests access to the rest.
+
+Already there:
+- `/api/discovery/me` (`getMyAccess`) — the "My Services" half.
+- `Resource.owner` + `<slug>_access` / `<slug>_admin` ResourceGroup links —
+  who approves, and which group an approval means joining.
+- The Notification model — the approval-request delivery mechanism.
+
+Gaps:
+1. **Catalog projection with metadata privacy.** `/api/discovery/resources`
+   returns full `metadata` to any authenticated user — including the OAuth
+   kind's `client_secret_hash`, and operator notes that may name internal
+   IPs. Needed: a per-kind public projection (name, description, kind,
+   subType, icon, address, hasAccess, requestable) and a private-key
+   convention for the rest (e.g. only `app_sso_directory_admin` sees full
+   metadata). This is a **fix worth doing before any catalog UI exists**.
+2. **`AccessRequest` model** — the one genuinely new model:
+   `{id, uid, resourceId, groupCn, status: pending|approved|denied, note,
+   requestedOn, decidedBy, decidedOn}`. Approval = LDAP group add + notify.
+   Endpoints: user POST/GET own; resource owner / directory admin
+   list/approve/deny.
+3. **Catalog metadata conventions**: `icon`, `tagline` (card-length blurb),
+   `requestable: false` for resources that shouldn't be advertised.
+
+### 9.2 SSH jump host (`username_-_{hostname-or-ip}@publicHost`)
+
+A public jump host parses the target out of the SSH username, checks the user
+may reach that host, and proxies the connection (WinSCP-friendly: one
+username string, no interactive menu needed — though an interactive picker on
+plain `username@` login is the same query).
+
+Already there:
+- Hosts carry `ip` (and `host_<hostname>` slugs to resolve by name).
+- Access is already group-based (`<slug>_access`), checkable via LDAP alone —
+  the jump host can run entirely off LDAP (SSSD) + one directory query.
+- User SSH keys are in LDAP (openssh-lpk) — the jump host authenticates the
+  real user without local accounts.
+
+Gaps:
+1. **Machine auth for the access query.** The jump host must ask "may user X
+   reach host Y" / "list hosts user X may reach" *about another user*.
+   `getMyAccess` only answers for the calling user. Needed: a
+   service-token-authenticated endpoint (`GET
+   /api/discovery/access/:uid[/:slug]`). `ServiceToken` already exists and
+   is even linked to a resource (`resource_id`) — what's missing is an auth
+   middleware that accepts it and a permission rule ("service tokens may
+   read access info, scoped read-only").
+2. **Connection metadata conventions** on hosts: `sshPort` (default 22),
+   optional `fqdn` (when IP is dynamic), optional `jumpVia` edge relation if
+   multi-hop topologies ever appear.
+3. Document the username grammar (`{uid}_-_{host-slug-or-ip}`) here so the
+   seed/ldap-client keep host slugs DNS-safe (they already are: slugify
+   strips everything but `[a-z0-9-]`).
+
+### 9.3 Firewall port-forward rules (build / update / drift-test)
+
+An automation renders the public firewall's forwarding table from the
+directory, applies it, and alerts on drift in either direction.
+
+Already there:
+- `metadata.port` / `metadata.externalPort` / `metadata.ip` /
+  `metadata.isExternalReachable` — the core mapping data, already seeded for
+  the stack's own services.
+
+Gaps:
+1. **Port-mapping convention is too thin for real rules**: no protocol, no
+   multi-port services. Adopt `metadata.portMappings: [{proto: "tcp"|"udp",
+   external: n, internal: n, comment}]` as the authoritative form
+   (`port`/`externalPort` stay as the simple single-mapping case).
+2. **Drift detection needs cheap change polling**: an `updated_on` timestamp
+   on resources surfaced in the graph API, or a graph-level etag/hash, so
+   the runner can poll without diffing full payloads. (The ORM already
+   publishes create/update events internally — a future push feed can ride
+   that; polling comes first.)
+3. Same **service-token read auth** as 9.2 — automation must not run on a
+   human's session token.
+
+### 9.4 Local DNS / mDNS
+
+A DNS (or mDNS advertiser) zone is generated from the directory: hosts get
+A records from `metadata.ip`, services get CNAMEs/records from their
+addresses, sites map to zones.
+
+Already there:
+- `host_<hostname>` + `ip` covers A records; `site_<name>` is a natural zone
+  boundary; service `address` yields names.
+
+Gaps:
+1. **Name conventions**: `metadata.dnsNames: []` for extra aliases, and a
+   documented rule for which name wins (slug vs `address` hostname). TTL
+   only if someone actually needs per-record TTLs — default is fine.
+2. Same **change detection** as 9.3 (poll `updated_on` / etag; push later).
+3. Nothing else — this consumer is nearly free once 9.3's conventions land.
+
+### 9.5 Access control for hosts
+
+Who may log in to / sudo on which machine, driven by the directory.
+
+Already there — this is the original point of the system:
+- `<slug>_access` / `<slug>_admin` groups are auto-provisioned per host;
+  ldap-client configures SSSD/PAM against the directory; `sudoRole` and
+  openssh-lpk schemas cover sudo and SSH keys.
+
+Gaps:
+1. **Close the loop in ldap-client**: joined hosts should set an SSSD access
+   filter (`access_provider = ldap`, filter on `host_<hostname>_access`
+   membership) so directory group membership *is* login permission, not just
+   identity. Today the registration exists but enforcement is host-side
+   convention.
+2. **`accessLevel` granularity**: ResourceGroup's `member`/`owner` maps to
+   login/admin today; if finer roles emerge (e.g. `login` vs `sudo` vs
+   `admin`), extend the enum — the join-table shape already supports it.
+
+### 9.6 Consolidated work list (model/API only, no consumers)
+
+Ordered by how much they unblock:
+
+1. **Metadata privacy projection** on the read API (blocks 9.1; fixes the
+   `client_secret_hash` exposure regardless of any consumer).
+2. **Service-token auth for `/api/discovery/*`** + `access/:uid` endpoint
+   (blocks 9.2, 9.3; ServiceToken model already exists).
+3. **`AccessRequest` model + endpoints** (blocks 9.1's request half).
+4. **Metadata conventions doc entries** (`sshPort`, `portMappings`,
+   `dnsNames`, `icon`, `tagline`, `requestable`) in `docs/directory.md` —
+   conventions, not schema changes; the json column already holds them.
+5. **`updated_on` in graph output / graph etag** (blocks drift/DNS
+   freshness; trivial once surfaced).

docs/concepts-accounts.md

@@ -46,7 +46,7 @@ on, just like anyone else's.
 
 A **group** is just a named list of accounts, used to control access. This
 app has a handful of built-in groups that grant admin powers (e.g. only
-people in the `app_sso_admin` group can see the Users/Groups/Integrations
+people in the `app_sso_admin` group can see the Users/Groups/Directory/Executive
 pages at all), but you can also make your own groups for any app you
 connect — say, a group listing everyone who should be allowed into your
 photo server. Once a group exists, add or remove members from the

docs/concepts-oauth-apps.md

@@ -28,7 +28,7 @@ what matters practically is the handful of concepts below.
 ## What's a "client"?
 
 Every app you connect is registered here as a **client** — a single entry
-on the Integrations page representing that one app. Registering a client
+in the Directory representing that one app. Registering a client
 gives you a **Client ID** and **Client Secret**: think of these like a
 username and password, but for the *app itself* rather than for a person.
 You paste them into the other app's own "Single Sign-On" or "OIDC" setup

docs/directory.md

@@ -58,6 +58,8 @@ Resources carry a flexible `metadata` JSON object that can store essential conte
 
 The Directory Management interface provides a **Tree View** toggle that visually nests your resources, making it easy to comprehend your network topography at a glance. You can also filter, search, and sort your entire infrastructure inventory. From the tree view, you can click the green `+` icon next to any resource to instantly add a child resource beneath it.
 
+<a href="images/directory.png" target="_blank"><img src="images/directory.png" alt="Directory & inventory list view" width="80%"></a>
+
 ## Slug conventions
 
 Slugs are the stable identifiers automation keys off, so the tooling around the SSO Manager follows a shared convention:
@@ -87,6 +89,14 @@ The seed is idempotent and non-destructive: a resource whose slug already exists
 
 The `ldap-client` join script enrolls a Debian/Ubuntu machine for LDAP login (SSSD/PAM), LDAP-backed `sudo`, and SSH keys from the directory — and, when given an SSO API token, registers the machine as a `host_<hostname>` resource with its IP, MAC, OS, and kernel, parented to the site named by its configured location.
 
+## Consumers of the directory
+
+The inventory graph isn't just documentation — other components read it to make decisions:
+
+- **[Jump Host](https://theta42.github.io/jump-host/)** — an SSH jump host that resolves which downstream machines a user may reach from their LDAP groups × the directory's `host` resources (`GET /api/discovery/resources?group=<cn>`), then bridges them in. The `host_<hostname>` slugs and `host_<slug>_access` groups this directory creates are exactly what it keys off; a host's `metadata.ip` / `metadata.sshPort` tell it where to connect. So a machine registered here (by theta-env or ldap-client) becomes reachable through the jump host the moment a user is in its access group.
+
+Planned consumers (end-user catalog, firewall/DNS generation) and the model/API gaps they need are tracked in [`directory_spec.md`](https://github.com/theta42/sso-manager-node/blob/master/directory_spec.md) §9.
+
 ## API
 
 All of the above uses the same admin API the UI does (group `app_sso_directory_admin` or `app_sso_admin`):

docs/index.md

@@ -22,10 +22,11 @@ one command).
 
 ## Screenshots
 
-<a href="images/dashboard.png" target="_blank"><img src="images/dashboard.png" alt="Dashboard" width="49%"></a>
+<a href="images/dashboard.png" target="_blank"><img src="images/dashboard.png" alt="Executive dashboard" width="49%"></a>
 <a href="images/users.png" target="_blank"><img src="images/users.png" alt="User list" width="49%"></a>
 <a href="images/groups.png" target="_blank"><img src="images/groups.png" alt="Groups" width="49%"></a>
-<a href="images/oauth-clients.png" target="_blank"><img src="images/oauth-clients.png" alt="OAuth clients" width="49%"></a>
+<a href="images/directory.png" target="_blank"><img src="images/directory.png" alt="Directory & inventory" width="49%"></a>
+<a href="images/oauth-clients.png" target="_blank"><img src="images/oauth-clients.png" alt="OAuth client (edit view)" width="49%"></a>
 
 *(click any screenshot to view full size)*
 
@@ -58,7 +59,7 @@ backend, that's the niche.
 - **All-in-one Docker image** — app + OpenLDAP + Redis in one container, or
   run the pieces separately via `app_*` env config.
 - **Geo-Location Scaling** — built-in support for N-Way Multi-Master OpenLDAP [replication](replication.html) across physical sites.
-- **[Directory & Inventory](directory.html)** — map sites, hosts, and services as a graph with rich metadata (IP/MAC, OS/kernel, ports, git repos), auto-provisioned access groups, and automatic registration from theta-env and ldap-client.
+- **[Directory & Inventory](directory.html)** — map sites, hosts, and services as a graph with rich metadata (IP/MAC, OS/kernel, ports, git repos), auto-provisioned access groups, and automatic registration from theta-env and ldap-client. Drives directory-aware tools like the [SSH jump host](https://theta42.github.io/jump-host/).
 
 ## Get it
 
@@ -78,5 +79,7 @@ That's the standalone quick start. For the full set of install options
 
 - **[Proxy](https://theta42.github.io/proxy/)** — an OIDC + LDAP-aware
   reverse proxy, designed to sit in front of this SSO.
+- **[Jump Host](https://theta42.github.io/jump-host/)** — an SSH jump host that
+  uses this SSO's directory to decide who may reach which machine.
 - **[theta-env](https://theta42.github.io/theta-env/)** — runs this SSO
   Manager and the proxy together with one command.

docs/oauth.md

@@ -64,6 +64,8 @@ Clients are managed directly from the **Directory** tab in the web UI. They are
 
 > All client-management actions use the standard Directory API (`/api/directory-admin/resources`) and are gated by the `app_sso_directory_admin` group.
 
+<a href="images/oauth-clients.png" target="_blank"><img src="images/oauth-clients.png" alt="Editing an OAuth client resource" width="80%"></a>
+
 ## Scopes
 
 | Scope | Claims / access |

nodejs/app.js

@@ -61,6 +61,11 @@ app.set('trust proxy', 1);
 app.set('views', path.join(__dirname, 'views'));
 app.set('view engine', 'ejs');
 
+// Per-app values for the shared UI shell (views/top.ejs + views/bottom.ejs).
+// Set as an app local so every res.render has it, including routes that don't
+// spread the routers' `values` object.
+app.locals.ui = require('./utils/ui');
+
 // Have express server static content( images, CSS, browser JS) from the public
 // local folder. maxAge is short since this is the app's own JS/CSS, which
 // changes on every deploy and isn't cache-busted/fingerprinted.
@@ -108,9 +113,6 @@ app.use(function(req, res, next) {
   next(err);
 });
 
-// Discovery API
-app.use('/api/discovery', middleware.auth, require('./routes/api_discovery'));
-
 // Error handling
 app.use(function(err, req, res, next) {
   const SILENT_404S = ['/.well-known/'];

nodejs/models/group_ldap.js

@@ -3,44 +3,18 @@
 const { Client, Attribute, Change } = require('ldapts');
 const { LRUCache } = require('lru-cache');
 const conf = require('@simpleworkjs/conf').ldap;
-
-// Escape a value used inside an LDAP search filter (RFC 4515).
-function escapeLDAPSearchValue(val) {
-	return String(val)
-		.replace(/\\/g, '\\5c')
-		.replace(/\*/g, '\\2a')
-		.replace(/\(/g, '\\28')
-		.replace(/\)/g, '\\29')
-		.replace(/\0/g, '\\00');
-}
-
-// Escape a value used in an LDAP DN (RFC 4514). Defensive: usernames/cns
-// are normally alphanumeric, but this prevents metacharacter injection.
-function escapeLDAPDNValue(val) {
-	return String(val)
-		.replace(/\\/g, '\\\\')
-		.replace(/,/g, '\\,')
-		.replace(/\+/g, '\\+')
-		.replace(/"/g, '\\"')
-		.replace(/</g, '\\<')
-		.replace(/>/g, '\\>')
-		.replace(/;/g, '\\;')
-		.replace(/=/g, '\\=')
-		.replace(/^\s|\s$/g, match => match === ' ' ? '\\ ' : match);
-}
+// Connection + escaping from the shared @simpleworkjs/ldap package. Local
+// wrappers preserve the no-arg call signatures; see user_ldap.js for rationale.
+const { makeClient: _makeClient, withClient: _withClient, escapeFilter, escapeDN } = require('@simpleworkjs/ldap');
+const escapeLDAPSearchValue = escapeFilter;
+const escapeLDAPDNValue = escapeDN;
 
 function makeClient() {
-	return new Client({ url: conf.url });
+	return _makeClient(conf);
 }
 
 async function withClient(fn) {
-	const client = makeClient();
-	try {
-		await client.bind(conf.bindDN, conf.bindPassword);
-		return await fn(client);
-	} finally {
-		await client.unbind().catch(() => {});
-	}
+	return _withClient(conf, fn);
 }
 
 async function getGroups(client, member){

nodejs/models/oauth_client.js

@@ -44,13 +44,21 @@ class OAuthClient {
 		return r;
 	}
 	static async get(client_id) {
+			const notFound = () => {
+				const e = new Error('OAuthClient not found');
+				e.status = 404;
+				return e;
+			};
 			let r;
 			try {
 				r = await Resource.get(client_id);
 			} catch (_) {
-				throw new Error('OAuthClient not found');
+				throw notFound();
 			}
-			if (r.kind !== 'oauth') throw new Error('OAuthClient not found');
+			// Resource.get() returns null (does not throw) for a missing id —
+			// guard it so a bad/undefined client_id is a clean 404, not a
+			// "Cannot read properties of null (reading 'kind')" 500.
+			if (!r || r.kind !== 'oauth') throw notFound();
 		// Map metadata to top-level properties to satisfy routes/oauth.js without rewriting it
 		r.client_id = r.id;
 		r.client_secret_hash = r.metadata.client_secret_hash;
@@ -69,6 +77,29 @@ class OAuthClient {
 			return raw_secret;
 		};
 
+		// The ORM Model.toJSON() only serializes schema fields, so the mapped
+		// properties above (client_id, scopes, redirect_uris, …) would be
+		// stripped from any res.json() — that's why GET /api/oauth/client
+		// returned client_id: undefined and the bootstrap's rotate blew up.
+		// Emit the public shape explicitly. client_secret_hash is deliberately
+		// omitted so it never leaks over the API.
+		r.toJSON = function () {
+			return {
+				client_id: r.id,
+				id: r.id,
+				kind: r.kind,
+				name: r.name,
+				slug: r.slug,
+				owner: r.owner,
+				description: r.description,
+				redirect_uris: r.redirect_uris,
+				scopes: r.scopes,
+				allowed_groups: r.allowed_groups,
+				token_lifetime: r.token_lifetime,
+				is_valid: r.is_valid,
+			};
+		};
+
 		// proxy update to handle metadata correctly
 		const originalUpdate = r.update.bind(r);
 		r.update = async (data) => {

nodejs/models/user_ldap.js

@@ -9,6 +9,14 @@ const {Token, InviteToken, PasswordResetToken} = require('./token');
 const {Group} = require('./group_ldap');
 const {UserVerification} = require('./verification');
 const conf = require('@simpleworkjs/conf').ldap;
+// Connection + escaping come from the shared @simpleworkjs/ldap package. The
+// wrappers below preserve this file's no-arg call signatures (makeClient() /
+// withClient(fn)) so no call site changes; sso's makeClient passes no
+// tlsOptions, which the shared client forwards as undefined — identical to the
+// previous `new Client({ url: conf.url })`.
+const { makeClient: _makeClient, withClient: _withClient, escapeFilter, escapeDN } = require('@simpleworkjs/ldap');
+const escapeLDAPSearchValue = escapeFilter;
+const escapeLDAPDNValue = escapeDN;
 
 function hashPasswordSSHA512(password) {
 	const salt = crypto.randomBytes(8);
@@ -23,40 +31,11 @@ const cache = new LRUCache({
 });
 
 function makeClient() {
-	return new Client({ url: conf.url });
+	return _makeClient(conf);
 }
 
 async function withClient(fn) {
-	const client = makeClient();
-	try {
-		await client.bind(conf.bindDN, conf.bindPassword);
-		return await fn(client);
-	} finally {
-		await client.unbind().catch(() => {});
-	}
-}
-
-// Helper to escape LDAP filter values (crucial for security)
-function escapeLDAPSearchValue(val) {
-    return val.replace(/\\/g, '\\5c')
-              .replace(/\*/g, '\\2a')
-              .replace(/\(/g, '\\28')
-              .replace(/\)/g, '\\29')
-              .replace(/\0/g, '\\00');
-}
-
-// Escape a value used in an LDAP DN (RFC 4514).
-function escapeLDAPDNValue(val) {
-	return String(val)
-		.replace(/\\/g, '\\\\')
-		.replace(/,/g, '\\,')
-		.replace(/\+/g, '\\+')
-		.replace(/"/g, '\\"')
-		.replace(/</g, '\\<')
-		.replace(/>/g, '\\>')
-		.replace(/;/g, '\\;')
-		.replace(/=/g, '\\=')
-		.replace(/^\s|\s$/g, match => match === ' ' ? '\\ ' : match);
+	return _withClient(conf, fn);
 }
 
 // Compute the next available uid/gidNumber: the highest existing value below
@@ -494,6 +473,19 @@ User.update = async function(data){
 			}
 
 			if(data.sshPublicKey){
+				// Ensure the auxiliary objectClass is present before setting the attribute
+				// -- accounts created before ldapPublicKey was added to addPosixAccount's
+				// objectclass list (e.g. the bootstrap admin) won't have it yet.
+				try {
+					await client.modify(this.dn, [
+						new Change({
+							operation: 'add',
+							modification: new Attribute({ type: 'objectClass', values: ['ldapPublicKey'] }),
+						}),
+					]);
+				} catch(e) {
+					if(e.name !== 'TypeOrValueExistsError') throw e;
+				}
 				await client.modify(this.dn, [
 					new Change({
 						operation: 'replace',
@@ -805,6 +797,19 @@ User.addSSHkey = async function(data) {
 	let result;
 	try {
 		await withClient(async (client) => {
+			// Ensure the auxiliary objectClass is present before setting the attribute
+			// -- accounts created before ldapPublicKey was added to addPosixAccount's
+			// objectclass list (e.g. the bootstrap admin) won't have it yet.
+			try {
+				await client.modify(user.dn, [
+					new Change({
+						operation: 'add',
+						modification: new Attribute({ type: 'objectClass', values: ['ldapPublicKey'] }),
+					}),
+				]);
+			} catch(e) {
+				if (e.name !== 'TypeOrValueExistsError') throw e;
+			}
 			await client.modify(user.dn, [
 				new Change({
 					operation: 'add',

nodejs/package-lock.json

@@ -1,17 +1,20 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.3.1",
+  "version": "1.5.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "t42-sso-manager",
-      "version": "1.3.1",
+      "version": "1.5.0",
       "license": "MIT",
       "dependencies": {
         "@fortawesome/fontawesome-free": "^7.3.0",
         "@popperjs/core": "^2.11.8",
+        "@simpleworkjs/app-stack": "^1.0.0",
         "@simpleworkjs/conf": "^1.2.0",
+        "@simpleworkjs/directory-schema": "^1.0.0",
+        "@simpleworkjs/ldap": "^1.0.0",
         "@simpleworkjs/orm": "^0.2.8",
         "bcrypt": "^6.0.0",
         "bootstrap": "^5.3.8",
@@ -21,9 +24,9 @@
         "express-rate-limit": "^8.5.2",
         "extend": "^3.0.2",
         "jq-repeat": "^2.2.0",
-        "jquery": "^3.7.1",
+        "jquery": "^4.0.0",
         "jsonwebtoken": "^9.0.3",
-        "ldapts": "^8.1.2",
+        "ldapts": "^8.1.8",
         "lru-cache": "^11.5.1",
         "marked": "^9.1.6",
         "model-redis": "^1.6.0",
@@ -1242,6 +1245,18 @@
         "@redis/client": "^6.1.0"
       }
     },
+    "node_modules/@simpleworkjs/app-stack": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@simpleworkjs/app-stack/-/app-stack-1.0.0.tgz",
+      "integrity": "sha512-Hg/mouA87WruKeZqhqtJgAaLabjHY8Z9POO6U+DB7sGGDhy1jgZXT31hyxLUDV+InByOPhz48NIkGiWNwoesXQ==",
+      "license": "MIT",
+      "dependencies": {
+        "express": "^5.2.1"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@simpleworkjs/conf": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/@simpleworkjs/conf/-/conf-1.2.0.tgz",
@@ -1254,6 +1269,27 @@
         "node": ">=16.0.0"
       }
     },
+    "node_modules/@simpleworkjs/directory-schema": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@simpleworkjs/directory-schema/-/directory-schema-1.0.0.tgz",
+      "integrity": "sha512-thZhPGNdDYlD8rlhXidnbCHTKjdSkj9ag1zE/gz1AwuclYypsKAP+v3BAvcZ/YDQP8RBDJNPXof5EpVheLovTg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@simpleworkjs/ldap": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@simpleworkjs/ldap/-/ldap-1.0.0.tgz",
+      "integrity": "sha512-saDmwk+KJ6kIWj9/MF37d+BM9KQisy6DsI9umyt1FWNyx6+wnEEat/1RUTwXKBd4IKJK+zPT5lC/B6gfa2CuAA==",
+      "license": "MIT",
+      "dependencies": {
+        "ldapts": "^8.1.8"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@simpleworkjs/orm": {
       "version": "0.2.8",
       "resolved": "https://registry.npmjs.org/@simpleworkjs/orm/-/orm-0.2.8.tgz",
@@ -4817,9 +4853,9 @@
       }
     },
     "node_modules/jquery": {
-      "version": "3.7.1",
-      "resolved": "https://registry.npmjs.org/jquery/-/jquery-3.7.1.tgz",
-      "integrity": "sha512-m4avr8yL8kmFN8psrbFFFmB/If14iN5o9nw/NgnnM+kybDJpRsAynV2BsfpTYrTRysYUdADVD7CkUUizgkpLfg==",
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/jquery/-/jquery-4.0.0.tgz",
+      "integrity": "sha512-TXCHVR3Lb6TZdtw1l3RTLf8RBWVGexdxL6AC8/e0xZKEpBflBsjh9/8LXw+dkNFuOyW9B7iB3O1sP7hS0Kiacg==",
       "license": "MIT"
     },
     "node_modules/js-tokens": {

nodejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.3.1",
+  "version": "1.5.1",
   "description": "A very simple LDAP management and SSO system",
   "author": [
     {
@@ -24,6 +24,9 @@
     "@fortawesome/fontawesome-free": "^7.3.0",
     "@popperjs/core": "^2.11.8",
     "@simpleworkjs/conf": "^1.2.0",
+    "@simpleworkjs/app-stack": "^1.0.0",
+    "@simpleworkjs/ldap": "^1.0.0",
+    "@simpleworkjs/directory-schema": "^1.0.0",
     "@simpleworkjs/orm": "^0.2.8",
     "bcrypt": "^6.0.0",
     "bootstrap": "^5.3.8",
@@ -33,9 +36,9 @@
     "express-rate-limit": "^8.5.2",
     "extend": "^3.0.2",
     "jq-repeat": "^2.2.0",
-    "jquery": "^3.7.1",
+    "jquery": "^4.0.0",
     "jsonwebtoken": "^9.0.3",
-    "ldapts": "^8.1.2",
+    "ldapts": "^8.1.8",
     "lru-cache": "^11.5.1",
     "marked": "^9.1.6",
     "model-redis": "^1.6.0",

nodejs/public/js/app.js

@@ -396,7 +396,7 @@ app.impersonate = (function(app){
 
 app.token = (function(app){
 	function list(name, callack){
-		if($.isFunction(name)){
+		if(typeof name === 'function'){
 			callack = name;
 			name = '';
 		}

nodejs/public/lib/js/app-base.js

@@ -1,3 +1,12 @@
+// Shared client framework for the theta42 apps.
+//
+// This file is byte-identical across sso-manager-node, proxy and jump-host —
+// per-app behaviour comes from the server (the `ui` locals in views/top.ejs and
+// the /api/user/me response), never from edits to this file. Edit all three
+// copies together.
+//
+// jQuery 4 safe: no $.isFunction, no $.holdReady.
+
 var app = {};
 
 app.pubsub = (function(){
@@ -75,11 +84,17 @@ app.socket = (function(app){
 app.api = (function(app){
 	var baseURL = '/api/'
 
-	function post(url, data, callback){
-		if (!$.isFunction(callback)) {
-			return new Promise((resolve, reject) => {
+	// post/put/delete are dual-mode: pass a callback for the node-style
+	// (error, data, status) form, or omit it to get a Promise that resolves
+	// with the parsed body and rejects with the error body. get/options return
+	// the jqXHR, which is itself thenable, so `await app.api.get(...)` works.
+
+	function body(method, url, data, callback){
+		if(typeof callback !== 'function'){
+			return new Promise(function(resolve, reject){
 				$.ajax({
-					type: 'POST', url: baseURL+url,
+					type: method,
+					url: baseURL+url,
 					headers: { 'auth-token': app.auth.getToken() },
 					data: JSON.stringify(data),
 					contentType: 'application/json; charset=utf-8',
@@ -88,9 +103,11 @@ app.api = (function(app){
 			});
 		}
 		return $.ajax({
-			type: 'POST',
+			type: method,
 			url: baseURL+url,
-			headers:{ 'auth-token': app.auth.getToken() },
+			headers:{
+				'auth-token': app.auth.getToken()
+			},
 			data: JSON.stringify(data),
 			contentType: "application/json; charset=utf-8",
 			dataType: "json",
@@ -104,40 +121,27 @@ app.api = (function(app){
 		});
 	}
 
+	function post(url, data, callback){
+		return body('POST', url, data, callback);
+	}
+
 	function put(url, data, callback){
-		if (!$.isFunction(callback)) {
-			return new Promise((resolve, reject) => {
-				$.ajax({
-					type: 'PUT', url: baseURL+url,
-					headers: { 'auth-token': app.auth.getToken() },
-					data: JSON.stringify(data),
-					contentType: 'application/json; charset=utf-8',
-					dataType: 'json',
-				}).done(resolve).fail(function(xhr){ reject(xhr.responseJSON || {}); });
-			});
-		}
-		return $.ajax({
-			type: 'PUT',
-			url: baseURL+url,
-			headers:{ 'auth-token': app.auth.getToken() },
-			data: JSON.stringify(data),
-			contentType: "application/json; charset=utf-8",
-			dataType: "json",
-			complete: function(res, text){
-				callback(
-					text !== 'success' ? res.statusText : null,
-					JSON.parse(res.responseText),
-					res.status
-				);
-			}
-		});
+		return body('PUT', url, data, callback);
 	}
 
-	function remove(url, callback){
-		if (!$.isFunction(callback)) {
-			return new Promise((resolve, reject) => {
+	// Called both as (url, callback) and — from formAJAX, which always passes
+	// the serialized form as the second argument — as (url, data, callback).
+	// No request body is sent either way.
+	function remove(url, data, callback){
+		if(typeof data === 'function'){
+			callback = data;
+			data = undefined;
+		}
+		if(typeof callback !== 'function'){
+			return new Promise(function(resolve, reject){
 				$.ajax({
-					type: 'DELETE', url: baseURL+url,
+					type: 'DELETE',
+					url: baseURL+url,
 					headers: { 'auth-token': app.auth.getToken() },
 					contentType: 'application/json; charset=utf-8',
 					dataType: 'json',
@@ -147,7 +151,9 @@ app.api = (function(app){
 		return $.ajax({
 			type: 'DELETE',
 			url: baseURL+url,
-			headers:{ 'auth-token': app.auth.getToken() },
+			headers:{
+				'auth-token': app.auth.getToken()
+			},
 			contentType: "application/json; charset=utf-8",
 			dataType: "json",
 			complete: function(res, text){
@@ -202,7 +208,10 @@ app.api = (function(app){
 })(app)
 
 app.auth = (function(app){
-	var user = {};
+	// One in-flight/cached GET /api/user/me per page load. Every gating
+	// decision (nav items, per-view forceLogin, group-required elements) reads
+	// this same promise instead of re-fetching.
+	var userPromise = null;
 
 	function setToken(token){
 		localStorage.setItem('APIToken', token);
@@ -216,35 +225,70 @@ app.auth = (function(app){
 		try{
 			return await app.api.get('user/me');
 		}catch(error){
-			if(error?.status === 401) return null;
-			throw error
+			if(error && error.status === 401) return null;
+			throw error;
 		}
 	}
 
+	// Cached current user, or false when there's no token at all. Callers that
+	// need a fresh copy (after a login or a profile change) pass force.
+	function loadUser(force){
+		if(force || !userPromise){
+			userPromise = getToken() ? getUser() : Promise.resolve(null);
+			userPromise = userPromise.then(function(user){
+				app.auth.user = app.auth.perms = user || null;
+				return user;
+			});
+		}
+		return userPromise;
+	}
+
+	// The apps report group membership two ways: sso-manager-node returns LDAP
+	// DNs in `memberOf`, the OIDC clients return plain CNs in `groups`. Both
+	// normalise to a list of CNs. `isAdmin` (the clients' effective-rights flag)
+	// is exposed as a synthetic `admin` group so one gating model covers both.
+	function groupCNs(user){
+		var raw = (user && (user.memberOf || user.groups)) || [];
+		if(!Array.isArray(raw)) raw = [raw];
+		var names = raw.map(function(group){
+			return String(group).split(',')[0].replace(/^cn=/i, '');
+		});
+		if(user && user.isAdmin && names.indexOf('admin') === -1) names.push('admin');
+		return names;
+	}
+
 	async function memberOf(groupNameToFind, user){
-		try{
-			user = user || await app.auth.asyncUser;
-			groupNameToFind = Array.isArray(groupNameToFind) ? groupNameToFind : [groupNameToFind]
+		user = user || await loadUser();
+		if(!user) return false;
+		groupNameToFind = Array.isArray(groupNameToFind) ? groupNameToFind : [groupNameToFind];
 
-			for(let group of user.memberOf){
-				group = group.split(',ou=groups')[0].replace('cn=', '');
-				if(groupNameToFind.includes(group)) return true;
-			}
-
-			return false;
-
-		}catch(error){
-			throw(error);
-		}
+		return groupCNs(user).some(function(group){
+			return groupNameToFind.includes(group);
+		});
 	}
 
-	async function isLoggedIn(){
-		if(getToken()){
-			user = await app.auth.asyncUser;
-			return user;
-		}else{
-			return false;
+	// True when the logged-in user is a global admin (per user/me). Sync — only
+	// meaningful once isLoggedIn/forceLogin has resolved.
+	function isAdmin(){
+		return !!(app.auth.perms && app.auth.perms.isAdmin);
+	}
+
+	// Dual-mode: returns a Promise resolving to the user (or false), and calls
+	// an optional node-style callback with the same result.
+	function isLoggedIn(callback){
+		var promise = loadUser().then(function(user){
+			return user || false;
+		});
+
+		if(typeof callback === 'function'){
+			promise.then(function(user){
+				callback(null, user);
+			}, function(error){
+				callback(error, false);
+			});
 		}
+
+		return promise;
 	}
 
 	function logIn(args, callback){
@@ -252,62 +296,125 @@ app.auth = (function(app){
 			if(data.login){
 				setToken(data.token);
 			}
+			loadUser(true);
 			callback(error, !!data.token);
 		});
 	}
 
+	// Clears the session only — the caller decides where to go next (the nav's
+	// Log Out button uses ui.logoutRedirect).
 	function logOut(callback){
 		localStorage.removeItem('APIToken');
-		location.replace(`/login${location.href.replace(location.origin, '')}`);
-		callback();
+		userPromise = null;
+		app.auth.user = app.auth.perms = null;
+		if(typeof callback === 'function') callback();
 	}
 
+	// Constrain a redirect target to a same-origin absolute path. Rejects
+	// absolute URLs (open redirect), protocol-relative "//host" and "/\host",
+	// and non-path schemes like "javascript:" (XSS). Falls back to "/".
+	function safeInternalPath(path){
+		if(typeof path !== 'string' || path.charAt(0) !== '/'
+				|| path.charAt(1) === '/' || path.charAt(1) === '\\'){
+			return '/';
+		}
+		return path;
+	}
+
+	// Consume an app token handed back by the OIDC callback via the URL
+	// fragment (#token=…&redirect=…). Stores it, strips the fragment, and
+	// forwards to the intended page. Returns true if a token was consumed.
+	function consumeTokenFragment(){
+		if(!location.hash) return false;
+		var params = new URLSearchParams(location.hash.replace(/^#/, ''));
+		var token = params.get('token');
+		if(!token) return false;
+
+		setToken(token);
+		// redirect comes from the URL fragment (attacker-controllable); only
+		// allow a same-origin path so it can't become an open redirect / XSS.
+		var redirect = safeInternalPath(params.get('redirect') || '/');
+		// Drop the token from the address bar before navigating on.
+		history.replaceState(null, '', location.pathname + location.search);
+		window.location.href = redirect;
+		return true;
+	}
+
+	// Page-level gate. jQuery 4 removed $.holdReady, so an unauthenticated or
+	// unauthorised user is kept off the page by a redirect / an error panel
+	// rather than by pausing document ready.
+	//
+	// `requiredGroups` is a group CN or an OR-list of them; the synthetic
+	// `admin` group covers the OIDC clients' isAdmin flag.
 	async function forceLogin(requiredGroups){
-		$.holdReady(true);
-		if(!await app.auth.isLoggedIn()) app.auth.logOut(function(){});
+		var user = await loadUser();
+
+		if(!user){
+			logOut(function(){});
+			location.replace('/login?redirect=' + encodeURIComponent(
+				location.pathname + location.search
+			));
+			return false;
+		}
 
 		if(user.onboardingRequired && location.pathname !== '/onboarding'){
 			location.replace('/onboarding');
+			return false;
 		}
 
-		if(requiredGroups){
-			if(!await memberOf(requiredGroups)){
-				console.log("Does not have permission!!!")
-				app.util.actionMessage(
-					`<h1>
-						<i class="fa-solid fa-triangle-exclamation"></i>
-						<b>You do not have permission to be here.</b>
-						<i class="fa-solid fa-triangle-exclamation"></i>
-					</h1>`,
-					$('#spa-shell'),
-					'danger',
-				);
-				throw new Error("User does not have permission");
-			}
+		if(requiredGroups && !await memberOf(requiredGroups, user)){
+			app.util.actionMessage(
+				`<h1>
+					<i class="fa-solid fa-triangle-exclamation"></i>
+					<b>You do not have permission to be here.</b>
+					<i class="fa-solid fa-triangle-exclamation"></i>
+				</h1>`,
+				$('#spa-shell'),
+				'danger',
+			);
+			throw new Error("User does not have permission");
 		}
 
-		$.holdReady(false);	
+		return user;
 	}
 
+	// Where to go after a successful login: the ?redirect= query param, or the
+	// legacy /login/<path> suffix form, constrained to a same-origin path. The
+	// suffix form keeps its query string — /login/oauth/authorize?client_id=…
+	// is how the OIDC provider sends an unauthenticated user through login.
 	function logInRedirect(){
-		window.location.href = location.href.replace(location.origin+'/login', '') || '/'
+		var params = new URLSearchParams(location.search);
+		var target = params.get('redirect')
+			|| location.href.replace(location.origin + '/login', '')
+			|| '/';
+		window.location.href = safeInternalPath(target);
 	}
 
 	return {
 		getToken: getToken,
 		setToken: setToken,
+		getUser: getUser,
+		loadUser: loadUser,
+		groupCNs: groupCNs,
+		memberOf: memberOf,
+		isAdmin: isAdmin,
 		isLoggedIn: isLoggedIn,
+		safeInternalPath: safeInternalPath,
+		consumeTokenFragment: consumeTokenFragment,
+		user: null,
+		perms: null,
 		logIn: logIn,
 		logOut: logOut,
 		forceLogin,
 		logInRedirect,
-		getUser,
-		memberOf,
 	}
 
 })(app);
-app.auth.asyncUser = app.auth.getUser();
 
+// Back-compat alias for views that awaited the cached user directly.
+Object.defineProperty(app.auth, 'asyncUser', {
+	get: function(){ return app.auth.loadUser(); },
+});
 
 app.user = (function(app){
 	function list(callback){
@@ -338,6 +445,72 @@ app.user = (function(app){
 
 })(app);
 
+// Local (app-managed) permissions and groups. Only the OIDC-client apps serve
+// these endpoints; the calls are inert elsewhere.
+app.permission = (function(app){
+	function list(callback){
+		app.api.get('permission/', function(error, data){
+			callback(error, data);
+		});
+	}
+
+	function subjects(callback){
+		app.api.get('permission/subjects', function(error, data){
+			callback(error, data);
+		});
+	}
+
+	function add(args, callback){
+		app.api.post('permission/', args, function(error, data){
+			callback(error, data);
+		});
+	}
+
+	function remove(id, callback){
+		app.api.delete('permission/' + encodeURIComponent(id), function(error, data){
+			callback(error, data);
+		});
+	}
+
+	return {list, subjects, add, remove};
+
+})(app);
+
+app.group = (function(app){
+	function list(callback){
+		app.api.get('group/', function(error, data){
+			callback(error, data);
+		});
+	}
+
+	function add(args, callback){
+		app.api.post('group/', args, function(error, data){
+			callback(error, data);
+		});
+	}
+
+	function remove(name, callback){
+		app.api.delete('group/' + encodeURIComponent(name), function(error, data){
+			callback(error, data);
+		});
+	}
+
+	function addMember(name, username, callback){
+		app.api.post('group/' + encodeURIComponent(name) + '/members', {username}, function(error, data){
+			callback(error, data);
+		});
+	}
+
+	function removeMember(name, username, callback){
+		app.api.delete('group/' + encodeURIComponent(name) + '/members/' + encodeURIComponent(username), function(error, data){
+			callback(error, data);
+		});
+	}
+
+	return {list, add, remove, addMember, removeMember};
+
+})(app);
+
 app.util = (function(app){
 
 	function getUrlParameter(name){
@@ -370,7 +543,10 @@ app.util = (function(app){
 		}else{
 			if(type) $target.addClass('bg-' + type);
 
-			if(!message.includes('<button')) message += `
+			// Messages that bring their own buttons (actionConfirm) are left
+			// alone; everything else gets the standard dismiss button.
+			if(!message.includes('<button')) message = `
+				<span class="align-middle">${message}</span>
 				<button class="action-close btn btn-sm btn-outline-dark float-end">
 					<i class="fa-solid fa-xmark"></i>
 				</button>
@@ -417,6 +593,9 @@ app.util = (function(app){
 			if (obj[name] === undefined) {
 				if (!value
 					&& !$(this).parent().find(`[name="${name}"]`).attr('value')
+					// Keep empty <textarea>s so a cleared field is submitted (and
+					// can reset a list, e.g. the per-host IP/header controls).
+					&& !$(this).filter(`textarea[name="${name}"]`).length
 				){
 					continue;
 				}
@@ -466,21 +645,36 @@ app.util = (function(app){
 	}
 })(app);
 
-$( document ).ready(async function(){
+// Reveal every .group-required-<cn> element the current user's groups entitle
+// them to. Elements carrying .group-required start hidden (styles.css), so a
+// user who is in no groups — or who isn't logged in — simply never sees them.
+app.auth.applyGroupVisibility = function(user){
+	var groups = app.auth.groupCNs(user);
+	if(!groups.length) return;
 
-	// Show content if the user has the correct group
-	for(let group of (await app.auth.asyncUser)?.memberOf || []){
+	var style = document.getElementById('group-required-rules');
+	if(!style){
+		style = document.createElement('style');
+		style.id = 'group-required-rules';
+		document.head.appendChild(style);
+	}
+
+	for(var group of groups){
 		try{
-			group = group.split(',ou=groups')[0].replace('cn=', '');
-
-			const sheet = document.styleSheets[0];
-			const selector = `.group-required-${group}`;
-			const cssText = `${selector} { display: revert !important; }`;
-			sheet.insertRule(cssText, sheet.cssRules.length);
+			style.sheet.insertRule(
+				`.group-required-${CSS.escape(group)} { display: revert !important; }`,
+				style.sheet.cssRules.length
+			);
 		}catch(error){
-			
+			// A group whose CN isn't a usable CSS identifier just gates nothing.
 		}
 	}
+};
+
+$( document ).ready(async function(){
+
+	// Show content the user's groups entitle them to.
+	app.auth.applyGroupVisibility(await app.auth.loadUser());
 
 	$('div.row').fadeIn('slow'); //show the page
 
@@ -567,4 +761,3 @@ function formAJAX(btn){
 		}
 	});
 }
-

nodejs/public/lib/js/val.js

@@ -61,7 +61,7 @@
 		//checks if empty to stop processing 
 		if(!isNaN(options) && value.length === 0) {
 		}else if(rule in settings.rule){
-			let message = settings.rule[rule].apply(this, [value, options]);
+			message = settings.rule[rule].apply(this, [value, options]);
 		}
 
 		this.validateMessage(message)
@@ -93,41 +93,109 @@
 
 }( jQuery ));
 
-$.validateSettings({
-	rule:{
-		ip: function( value ) {
-			value = value.split( '.' );
+// Host / target validation, mirrored from the backend (utils/hostname_validate.js):
+// a bare hostname or IPv4 address, no protocol / "/" / ":" / whitespace. The
+// incoming host may be a wildcard ("*.example.com"); the target may not.
+(function(){
+	var LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
+	// Either one bare label (Docker service names, /etc/hosts entries) or a
+	// dotted hostname with an alphabetic TLD.
+	var HOSTNAME = /^(?=.{1,253}$)(?:(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}|[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)$/i;
+	var FORBIDDEN = /[\s/:]/;
 
-			if ( value.length != 4 ) {
-				return "Malformed IP";
-			}
+	function isIPv4( value ) {
+		var parts = value.split( '.' );
+		if ( parts.length !== 4 ) return false;
+		return parts.every( function( p ) {
+			return /^(0|[1-9]\d{0,2})$/.test( p ) && Number( p ) <= 255;
+		});
+	}
 
-			$.each( value, function( key, value ) {
-				if( value > 255 || value < 0 ) {
+	// Incoming-host pattern: labels may be normal, "*" (one fragment), or "**"
+	// (any number of fragments, incl. a bare "**" global catch-all).
+	function isHostPattern( value ) {
+		if ( value.length > 253 ) return false;
+		return value.split( '.' ).every( function( l ) {
+			return l === '*' || l === '**' || LABEL.test( l );
+		});
+	}
+
+	function forbidden( value ) {
+		return FORBIDDEN.test( value ) || value.includes( '://' );
+	}
+
+	// Incoming host: IPv4 or a wildcard host pattern.
+	function checkHost( value ) {
+		if ( typeof value !== 'string' || value.length === 0 ) return "Required";
+		if ( forbidden( value ) ) return 'No protocol, "/", or ":"';
+		if ( isIPv4( value ) || isHostPattern( value ) ) return;
+		return "Enter a valid host or wildcard (*, **)";
+	}
+
+	// Downstream target: IPv4 or a strict hostname, no wildcard.
+	function checkTarget( value ) {
+		if ( typeof value !== 'string' || value.length === 0 ) return "Required";
+		if ( forbidden( value ) ) return 'No protocol, "/", or ":"';
+		if ( isIPv4( value ) || HOSTNAME.test( value ) ) return;
+		return "Enter a valid hostname or IP";
+	}
+
+	$.validateSettings({
+		rule:{
+			ip: function( value ) {
+				value = value.split( '.' );
+
+				if ( value.length != 4 ) {
 					return "Malformed IP";
 				}
-			});
-		},
 
-		host: function( value ) {
-			var reg = /^(?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\.?$/;
-			if ( reg.test( value ) === false ) {
-				return "Invalid";
-			}
-		},
+				$.each( value, function( key, value ) {
+					if( value > 255 || value < 0 ) {
+						return "Malformed IP";
+					}
+				});
+			},
 
-		user: function( value ) {
-			var reg = /^[a-z0-9\_\-\@\.]{1,32}$/;
-			if ( reg.test( value ) === false ) {
-				return "Invalid";
-			}
-		},
+			// Incoming host name — hostname, IPv4, or wildcard pattern (*, **).
+			host: function( value ) {
+				return checkHost( value );
+			},
 
-		password: function( value ) {
-			var reg = /^(?=[^\d_].*?\d)\w(\w|[!@#$%]){1,48}/;
-			if ( reg.test( value ) === false ) {
-				return "Weak password, Try again";
+			// Downstream target — hostname or IPv4, no wildcard.
+			target: function( value ) {
+				return checkTarget( value );
+			},
+
+			// Back-compat alias (no wildcard).
+			hostname: function( value ) {
+				return checkTarget( value );
+			},
+
+			user: function( value ) {
+				var reg = /^[a-z0-9\_\-\@\.]{1,32}$/;
+				if ( reg.test( value ) === false ) {
+					return "Invalid";
+				}
+			},
+
+			// Mirrors utils/password_policy.js: >= 8 chars, and either 12+ chars
+			// or at least 3 of {lowercase, uppercase, number, symbol}.
+			password: function( value ) {
+				if ( typeof value !== 'string' || value.length < 8 ) {
+					return "Password must be at least 8 characters";
+				}
+				if ( value.length >= 12 ) return;
+
+				var classes = 0;
+				if ( /[a-z]/.test( value ) ) classes++;
+				if ( /[A-Z]/.test( value ) ) classes++;
+				if ( /[0-9]/.test( value ) ) classes++;
+				if ( /[^A-Za-z0-9]/.test( value ) ) classes++;
+
+				if ( classes < 3 ) {
+					return "Use 3 of: lowercase, uppercase, number, symbol (or 12+ chars)";
+				}
 			}
 		}
-	}
-});
+	});
+})();

nodejs/routes/api_directory_admin.js

@@ -3,6 +3,7 @@ const router = require('express').Router();
 const permission = require('../utils/permission');
 const { Resource, ResourceEdge, ResourceGroup } = require('../models/resource');
 const { Group } = require('../models/group_ldap');
+const { projectResources } = require('@simpleworkjs/directory-schema');
 
 // Require the admin group
 router.use(async (req, res, next) => {
@@ -18,7 +19,9 @@ router.use(async (req, res, next) => {
 router.get('/resources', async (req, res, next) => {
   try {
     const resources = await Resource.list();
-    res.json({ results: resources });
+    // Even admins never receive secret metadata (e.g. client_secret_hash) over
+    // the wire; projectResources strips it unconditionally.
+    res.json({ results: projectResources(resources, { fullMetadata: true }) });
   } catch (err) { next(err); }
 });
 

nodejs/routes/api_discovery.js

@@ -1,36 +0,0 @@
-'use strict';
-
-const router = require('express').Router();
-const { Resource, ResourceGroup } = require('../models/resource');
-
-// GET /api/discovery/me
-// Returns the list of resources the current user has access to.
-router.get('/me', async (req, res, next) => {
-  try {
-    const userGroups = req.user.groups || []; // array of LDAP group CNs
-    const accessibleResourceIds = new Set();
-    
-    if (req.user.isMachine) {
-        // Machines only have access to themselves by default
-        accessibleResourceIds.add(req.resourceId);
-    } else {
-        // End users get access via groups
-        const allGroups = await ResourceGroup.list();
-        for (const rg of allGroups) {
-            if (userGroups.includes(rg.groupCn)) {
-                accessibleResourceIds.add(rg.resourceId);
-            }
-        }
-    }
-    
-    // Fetch all resources and filter
-    const allResources = await Resource.list();
-    const accessible = allResources.filter(r => accessibleResourceIds.has(r.id) || r.metadata?.isPublic);
-    
-    res.json({ results: accessible });
-  } catch (err) {
-    next(err);
-  }
-});
-
-module.exports = router;

nodejs/routes/discovery.js

@@ -1,4 +1,79 @@
-const autoRouter = require('./autoRouter');
-const { Resource } = require('../models/resource');
+'use strict';
 
-module.exports = autoRouter(Resource);
+// Public directory discovery API. Mounted at /api/discovery (app.js, before
+// the 404 catcher). Every response uses the `{ results }` envelope and the
+// security projection from @simpleworkjs/directory-schema, so secrets (e.g. an
+// OAuth client's client_secret_hash) never leave the server and non-admins only
+// see the public metadata allowlist.
+//
+// This replaces the autoRouter mount (which returned bare arrays — the shape
+// jump-host's `data.results || []` silently collapsed to `[]`, so no user could
+// bridge) and absorbs the dead /me handler that used to live in
+// routes/api_discovery.js (mounted after the 404, so unreachable).
+
+const router = require('express').Router();
+const { Resource, ResourceGroup } = require('../models/resource');
+const {
+	envelope,
+	projectResource,
+	projectResources,
+	isDirectoryAdmin,
+} = require('@simpleworkjs/directory-schema');
+
+// GET /api/discovery/resources[?kind=&group=&parent=]
+router.get('/resources', async (req, res, next) => {
+	try {
+		const resources = await Resource.search(req.query);
+		res.json(envelope(projectResources(resources, { fullMetadata: isDirectoryAdmin(req.user) })));
+	} catch (err) { next(err); }
+});
+
+// GET /api/discovery/resources/:slug
+router.get('/resources/:slug', async (req, res, next) => {
+	try {
+		const resource = await Resource.getBySlug(req.params.slug);
+		// parents/children are edges (no secrets); project only the resource body.
+		const projected = projectResource(resource, { fullMetadata: isDirectoryAdmin(req.user) });
+		projected.parents = resource.parents;
+		projected.children = resource.children;
+		res.json(envelope(projected));
+	} catch (err) { next(err); }
+});
+
+// GET /api/discovery/graph
+router.get('/graph', async (req, res, next) => {
+	try {
+		const graph = await Resource.getGraph();
+		res.json(envelope({
+			resources: projectResources(graph.resources, { fullMetadata: isDirectoryAdmin(req.user) }),
+			edges: graph.edges,
+		}));
+	} catch (err) { next(err); }
+});
+
+// GET /api/discovery/me
+// Returns the resources the current caller can reach. Machines see only their
+// own resource; humans get the union of their LDAP groups' resources plus
+// anything flagged isPublic. Uses req.user.groups (populated by the auth
+// middleware for session/PAT callers) rather than re-querying LDAP by DN, so it
+// works for every auth transport without assuming a .dn is present.
+router.get('/me', async (req, res, next) => {
+	try {
+		let accessible;
+		if (req.user && req.user.isMachine) {
+			accessible = await Resource.list({ where: { id: req.resourceId } });
+		} else {
+			const userGroups = (req.user && req.user.groups) || [];
+			const ids = new Set();
+			if (userGroups.length) {
+				const rgs = await ResourceGroup.list({ where: { groupCn: { in: userGroups } } });
+				for (const rg of rgs) ids.add(rg.resourceId);
+			}
+			const all = await Resource.list();
+			accessible = all.filter(r => ids.has(r.id) || (r.metadata && r.metadata.isPublic));
+		}
+		res.json(envelope(projectResources(accessible, { fullMetadata: isDirectoryAdmin(req.user) })));
+	} catch (err) { next(err); }
+});
+
+module.exports = router;

nodejs/routes/index.js

@@ -10,6 +10,7 @@ const {InviteToken, PasswordResetToken} = require('./../models/token');
 const {Tos} = require('../models/tos');
 const conf = require('@simpleworkjs/conf');
 const buildInfo = require('../utils/build_info');
+const { mountStaticModules } = require('@simpleworkjs/app-stack');
 
 const values ={
   title: conf.environment !== 'production' ? `dev` : '',
@@ -20,24 +21,16 @@ const values ={
 }
 
 // List of front end node modules to be served
-const frontEndModules = ['bootstrap', 'mustache', 'jquery', '@fortawesome',
-  'moment', '@popper', 'jq-repeat',
-];
-
-// Server front end modules
-// https://stackoverflow.com/a/55700773/3140931
 // Vendor libraries only change when package versions are bumped (a rebuild),
 // so they're safe to cache aggressively; ETag/Last-Modified (on by default)
-// still cover that rare case with a cheap 304 instead of a stale asset.
-frontEndModules.forEach(dep => {
-  router.use(`/static-modules/${dep}`, express.static(path.join(__dirname, `../node_modules/${dep}`), {maxAge: '7d'}))
+// still cover that rare case with a cheap 304 instead of a stale asset. The
+// app's own JS/CSS/img from public/ gets a shorter maxAge since it changes on
+// every deploy and isn't cache-busted/fingerprinted.
+mountStaticModules(router, {
+  root: path.join(__dirname, '..'),
+  deps: ['bootstrap', 'mustache', 'jquery', '@fortawesome', 'moment', '@popper', 'jq-repeat'],
 });
 
-// Have express server static content( images, CSS, browser JS) from the public
-// local folder. Shorter maxAge than /static-modules since this is the app's
-// own JS/CSS, which changes on every deploy and isn't cache-busted/fingerprinted.
-router.use('/static', express.static(path.join(__dirname, '../public'), {maxAge: '1h'}))
-
 // Public health endpoint for container/orchestration healthchecks.
 // Mounted at / (no auth) in app.js, so this is intentionally unauthenticated.
 router.get('/health', function(req, res) {

nodejs/routes/user.js

@@ -74,7 +74,17 @@ router.delete('/:uid', async function(req, res, next){
 
 router.get('/me', async function(req, res, next){
 	try{
-		return res.json(await User.get({uid: req.user.uid}));
+		const user = JSON.parse(JSON.stringify(await User.get({uid: req.user.uid})));
+
+		// The shared client framework gates the UI on a single effective-rights
+		// flag (the OIDC-client apps send the same key). Here "admin" means
+		// membership in app_sso_admin; group-level gating still reads memberOf.
+		const groups = (user.memberOf || []).map(function(dn){
+			return String(dn).split(',')[0].replace(/^cn=/i, '');
+		});
+		user.isAdmin = groups.includes('app_sso_admin');
+
+		return res.json(user);
 	}catch(error){
 		next(error);
 	}

nodejs/tests/discovery.test.js

@@ -0,0 +1,111 @@
+'use strict';
+
+// Directory discovery API — security + contract regression coverage.
+//
+// These tests run under the jest + docker harness (redis + the test seed).
+// They lock in the two fixes from the @simpleworkjs/directory-schema release:
+//   1. /api/discovery/* returns the { results } envelope (not a bare array —
+//      the drift that made jump-host's `data.results || []` collapse to []).
+//   2. No response path leaks secret metadata (e.g. an OAuth client's
+//      client_secret_hash), regardless of caller.
+//
+// The core assertions hold for any authenticated caller. The admin-projection
+// assertion (fullMetadata for directory admins) additionally requires the `test`
+// seed user to be a member of app_sso_directory_admin — see setup.js.
+
+const { login, request, app } = require('./setup');
+
+let token;
+
+beforeAll(async () => {
+	token = await login();
+});
+
+function assertNoSecrets(results, path) {
+	for (const r of results || []) {
+		// toBeUndefined() in this jest version takes no message arg, so assert
+		// manually and throw with context — this also surfaces the leaked value
+		// if the projection ever regresses.
+		const secretHash = r.metadata && r.metadata.client_secret_hash;
+		if (secretHash !== undefined) {
+			throw new Error(
+				`client_secret_hash leaked from ${path} on ${r.slug || r.id} (value: ${JSON.stringify(secretHash)})`
+			);
+		}
+		if (r.metadata) {
+			for (const k of Object.keys(r.metadata)) {
+				if (/secret|password|privatekey/i.test(k)) {
+					throw new Error(`secret-ish key "${k}" leaked from ${path} on ${r.slug || r.id}`);
+				}
+			}
+		}
+	}
+}
+
+describe('Discovery — envelope + security', () => {
+	test('GET /api/discovery/resources returns 200 with { results } (not a bare array)', async () => {
+		const res = await request(app).get('/api/discovery/resources').set('auth-token', token);
+		expect(res.status).toBe(200);
+		expect(Array.isArray(res.body.results)).toBe(true);
+		expect(Array.isArray(res.body)).toBe(false); // never a bare array
+	});
+
+	test('GET /api/discovery/resources never leaks client_secret_hash', async () => {
+		const res = await request(app).get('/api/discovery/resources').set('auth-token', token);
+		assertNoSecrets(res.body.results, '/resources');
+	});
+
+	test('GET /api/discovery/resources?group= returns 200 (regression: was 404)', async () => {
+		const res = await request(app)
+			.get('/api/discovery/resources?group=host_web01_access')
+			.set('auth-token', token);
+		expect(res.status).toBe(200);
+		expect(Array.isArray(res.body.results)).toBe(true);
+	});
+
+	test('GET /api/discovery/graph returns { results: { resources, edges } } and strips secrets', async () => {
+		const res = await request(app).get('/api/discovery/graph').set('auth-token', token);
+		expect(res.status).toBe(200);
+		expect(res.body.results).toBeDefined();
+		expect(Array.isArray(res.body.results.resources)).toBe(true);
+		assertNoSecrets(res.body.results.resources, '/graph');
+	});
+
+	test('GET /api/discovery/me returns 200 with { results } and strips secrets', async () => {
+		const res = await request(app).get('/api/discovery/me').set('auth-token', token);
+		expect(res.status).toBe(200);
+		expect(Array.isArray(res.body.results)).toBe(true);
+		assertNoSecrets(res.body.results, '/me');
+	});
+
+	test('GET /api/discovery/resources/:slug returns 200 + { results } for a known slug', async () => {
+		// Seed-dependent: pick the first slug from the list, then fetch it.
+		const list = await request(app).get('/api/discovery/resources').set('auth-token', token);
+		const slug = list.body.results[0] && list.body.results[0].slug;
+		if (!slug) return; // empty seed — skip rather than fail
+		const res = await request(app)
+			.get(`/api/discovery/resources/${encodeURIComponent(slug)}`)
+			.set('auth-token', token);
+		expect(res.status).toBe(200);
+		expect(res.body.results).toBeDefined();
+		expect(res.body.results.slug).toBe(slug);
+		assertNoSecrets([res.body.results], '/resources/:slug');
+	});
+});
+
+describe('Discovery — admin projection (requires test user in app_sso_directory_admin)', () => {
+	// If the seed `test` user is a directory admin, /resources should keep
+	// admin-only (non-secret) metadata like redirect_uris/token_lifetime for
+	// them. If not, this assertion is skipped — the no-secrets assertion above
+	// already covers the security guarantee for every caller.
+	test('admin callers keep token_lifetime / redirect_uris (non-secret admin keys)', async () => {
+		const res = await request(app).get('/api/discovery/resources?kind=oauth').set('auth-token', token);
+		const oauth = (res.body.results || []).find(r => r.kind === 'oauth');
+		if (!oauth) return; // no oauth resource seeded
+		// Only meaningful if the caller is an admin; non-admins correctly get
+		// the public allowlist (no redirect_uris). We assert the absence of
+		// secrets regardless, and skip the positive admin check without a known
+		// admin seed.
+		expect(oauth.metadata && oauth.metadata.client_secret_hash).toBeUndefined();
+	});
+});

nodejs/tests/oauth.test.js

@@ -43,6 +43,65 @@ afterAll(async () => {
 	}
 });
 
+describe('OAuth client management API — /api/oauth/client', () => {
+	// Regression: the ORM Model.toJSON() strips non-schema fields, so the
+	// mapped client_id/scopes/etc. used to vanish from GET responses —
+	// client_id came back undefined and the theta-env bootstrap's rotate
+	// crashed with a 500. GET must expose client_id (and never the secret hash).
+	test('GET / list exposes client_id and hides client_secret_hash', async () => {
+		const res = await request(app)
+			.get('/api/oauth/client/')
+			.set('auth-token', token);
+		expect(res.status).toBe(200);
+		const mine = res.body.results.find((c) => c.client_id === clientId);
+		expect(mine).toBeDefined();
+		expect(mine.client_id).toBe(clientId);
+		expect(mine).toHaveProperty('scopes');
+		expect(mine).not.toHaveProperty('client_secret_hash');
+	});
+
+	test('GET /:id exposes client_id', async () => {
+		const res = await request(app)
+			.get(`/api/oauth/client/${clientId}`)
+			.set('auth-token', token);
+		expect(res.status).toBe(200);
+		expect(res.body.results.client_id).toBe(clientId);
+		expect(res.body.results).not.toHaveProperty('client_secret_hash');
+	});
+
+	test('list then rotate a client by its returned client_id (the bootstrap path)', async () => {
+		// Reproduces exactly what the theta-env bootstrap does: create, list,
+		// find by name, rotate by the client_id from the list response. Uses a
+		// throwaway client so the shared flow client's secret is untouched.
+		const created = await request(app)
+			.post('/api/oauth/client/')
+			.set('auth-token', token)
+			.send({ name: 'rotate-regression', redirect_uris: REDIRECT_URI });
+		expect(created.status).toBe(200);
+
+		const list = await request(app).get('/api/oauth/client/').set('auth-token', token);
+		const found = list.body.results.find((c) => c.name === 'rotate-regression');
+		expect(found).toBeDefined();
+		expect(found.client_id).toBeTruthy(); // was undefined before the fix
+
+		const rotated = await request(app)
+			.post(`/api/oauth/client/${found.client_id}/rotate`)
+			.set('auth-token', token);
+		expect(rotated.status).toBe(200);
+		expect(rotated.body.client_secret).toBeTruthy();
+
+		await request(app).delete(`/api/oauth/client/${found.client_id}`).set('auth-token', token);
+	});
+
+	test('GET /:id unknown id returns 404, not 500', async () => {
+		const res = await request(app)
+			.get('/api/oauth/client/00000000-0000-0000-0000-000000000000')
+			.set('auth-token', token);
+		expect(res.status).toBeGreaterThanOrEqual(400);
+		expect(res.status).toBeLessThan(500);
+	});
+});
+
 describe('OIDC Discovery', () => {
 	test('GET /.well-known/openid-configuration returns required fields', async () => {
 		const res = await request(app).get('/.well-known/openid-configuration');

nodejs/utils/build_info.js

@@ -1,29 +1,16 @@
 'use strict';
 
-const fs = require('fs');
+// Unified build-info shape ({ buildVersion, buildHash, buildYear }) via the
+// shared @simpleworkjs/app-stack. The baked commit file lives at nodejs/.build_commit
+// (../ from here in utils/), matching the Dockerfile.openldap gitinfo stage;
+// cwd is utils/ for the bare-metal git fallback.
+
 const path = require('path');
-const { execSync } = require('child_process');
-const { version: buildVersion } = require('../package.json');
+const { createBuildInfo } = require('@simpleworkjs/app-stack');
+const { version } = require('../package.json');
 
-// Docker builds bake the commit hash into ../.build_commit (see the gitinfo
-// stage in Dockerfile.openldap) -- the final image has no git binary and no
-// .git directory, so `git rev-parse` below always fails there. Bare-metal/dev
-// runs have no baked file, so they fall back to asking git directly.
-function readBuildHash() {
-	try {
-		const baked = fs.readFileSync(path.join(__dirname, '../.build_commit'), 'utf8').trim();
-		if (baked) return baked;
-	} catch (_) {}
-
-	try {
-		return execSync('git rev-parse --short HEAD', { cwd: __dirname }).toString().trim();
-	} catch (_) {
-		return 'unknown';
-	}
-}
-
-module.exports = {
-	buildVersion,
-	buildHash: readBuildHash(),
-	buildYear: new Date().getFullYear(),
-};
+module.exports = createBuildInfo({
+	version,
+	buildCommitPath: path.join(__dirname, '../.build_commit'),
+	cwd: __dirname,
+});

nodejs/utils/ui.js

@@ -0,0 +1,46 @@
+'use strict';
+
+// Per-app values for the shared UI shell (views/top.ejs + views/bottom.ejs).
+//
+// Those two partials are byte-identical across sso-manager-node, proxy and
+// jump-host — everything that differs between the apps lives here and is
+// exposed to every render as `ui` via app.locals (see app.js). Keep the key set
+// in sync across the three apps; a missing key is a render-time ReferenceError,
+// not a silent fallback.
+
+const conf = require('@simpleworkjs/conf');
+
+module.exports = {
+	// --- footer -------------------------------------------------------------
+	repoUrl: 'https://github.com/theta42/sso-manager-node',
+	licenseUrl: 'https://github.com/theta42/sso-manager-node/blob/master/LICENSE',
+	// In-app docs route (routes/docs.js). Apps without one point at the
+	// published docs site and set docsExternal.
+	docsUrl: '/docs',
+	docsExternal: false,
+	// Only sso-manager-node serves a Terms of Service page; null hides the link.
+	tosUrl: '/tos',
+
+	// --- header / nav -------------------------------------------------------
+	faviconUrl: conf.logo,
+	// Where the current-user chip links. null renders it as a plain span (for
+	// apps with no profile page).
+	profileUrl: '/profile',
+	// Where "Log Out" lands.
+	logoutRedirect: '/',
+	// Admin-only "a newer release is available" banner, backed by
+	// GET /api/update-check. Apps without that endpoint set false.
+	updateCheck: true,
+	updateLabel: 'SSO Manager',
+
+	// Nav items, in order. `groups` is an OR-list of group CNs that may see the
+	// item; an empty list means "always visible". Gating is done client-side by
+	// app-base.js, which reveals .group-required-<cn> for each group the user is
+	// in (plus the synthetic `admin` group when user/me reports isAdmin).
+	nav: [
+		{href: '/users', icon: 'fa-solid fa-users', label: 'Users', groups: ['app_sso_admin']},
+		{href: '/groups', icon: 'fa-solid fa-users-viewfinder', label: 'Groups', groups: ['app_sso_admin']},
+		{href: '/directory', icon: 'fa-solid fa-server', label: 'Directory', groups: ['app_sso_admin', 'app_sso_directory_admin']},
+		{href: '/executive', icon: 'fa-solid fa-gauge-high', label: 'Executive', groups: ['app_sso_admin']},
+	],
+};

nodejs/views/bottom.ejs

@@ -1,5 +1,8 @@
 		</div><!-- end spa-shell -->
 
+	<!-- Shared UI shell — byte-identical across sso-manager-node, proxy and
+	     jump-host. Everything per-app comes from `ui` (utils/ui.js, exposed via
+	     app.locals in app.js). Edit all three copies together. -->
 	<footer class="py-2 bg-dark text-light mt-4">
 		<div class="container-fluid d-flex flex-wrap justify-content-between align-items-center small gap-2">
 			<span class="d-flex align-items-center gap-2">
@@ -7,19 +10,21 @@
 					<img width="64" src="/static/img/theta42.svg"/>
 				</a>
 				&copy; <%- buildYear %> theta42 &middot;
-				<a href="https://github.com/theta42/sso-manager-node/blob/master/LICENSE" target="_blank" class="text-light">MIT License</a>
+				<a href="<%- ui.licenseUrl %>" target="_blank" class="text-light">MIT License</a>
 			</span>
 			<span class="d-flex align-items-center gap-3">
-				<a href="/docs" class="text-light text-decoration-none">
+				<a href="<%- ui.docsUrl %>"<%- ui.docsExternal ? ' target="_blank"' : '' %> class="text-light text-decoration-none">
 					<i class="fa-solid fa-book"></i> Docs
 				</a>
-				<a href="https://github.com/theta42/sso-manager-node" target="_blank" class="text-light text-decoration-none">
+				<a href="<%- ui.repoUrl %>" target="_blank" class="text-light text-decoration-none">
 					<i class="fa-brands fa-github"></i> GitHub
 				</a>
-				<a href="/tos" class="text-light text-decoration-none">Terms of Service</a>
+				<% if(ui.tosUrl){ %>
+				<a href="<%- ui.tosUrl %>" class="text-light text-decoration-none">Terms of Service</a>
+				<% } %>
 			</span>
 			<span>v<%- buildVersion %> (<%- buildHash %>)</span>
 		</div>
 	</footer>
-    </body>
+	</body>
 </html>

nodejs/views/directory.ejs

@@ -572,6 +572,8 @@
         $target.append($('<option>').val(r.id).text(r.name + ' (' + r.slug + ')'));
       } else if (kind === 'service' && (r.kind === 'host' || r.kind === 'service')) {
         $target.append($('<option>').val(r.id).text(r.name + ' (' + r.slug + ')'));
+      } else if (kind === 'oauth' && r.kind === 'service') {
+        $target.append($('<option>').val(r.id).text(r.name + ' (' + r.slug + ')'));
       }
     });
     if (selectedId) $target.val(selectedId);

nodejs/views/top.ejs

@@ -1,138 +1,149 @@
 <!doctype html>
 <html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-    <title><%- name %> <%- title %></title>
-    <!-- Favicon -->
-    <link rel="icon" type="image/svg+xml" href="<%- logo %>">
-    <!-- CSS are placed here -->
-    <link rel="stylesheet" href="/static-modules/bootstrap/dist/css/bootstrap.min.css">
-    <link rel="stylesheet" href="/static-modules/@fortawesome/fontawesome-free/css/all.min.css">
+	<head>
+		<meta charset="utf-8">
+		<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+		<title><%- name %> <%- title %></title>
+		<!-- Shared UI shell — byte-identical across sso-manager-node, proxy and
+		     jump-host. Everything per-app comes from `ui` (utils/ui.js, exposed
+		     via app.locals in app.js). Edit all three copies together. -->
+		<!-- Favicon -->
+		<link rel="icon" type="image/svg+xml" href="<%- ui.faviconUrl %>">
+		<!-- CSS are placed here -->
+		<link rel="stylesheet" href="/static-modules/bootstrap/dist/css/bootstrap.min.css">
+		<link rel="stylesheet" href="/static-modules/@fortawesome/fontawesome-free/css/all.min.css">
 
-    <link rel='stylesheet' href='/static/css/styles.css' />
-    <!-- Scripts are placed here -->
-    <script type="text/javascript" src="/socket.io/socket.io.js"></script>
-    <script type="text/javascript" src='/static-modules/jquery/dist/jquery.js'></script>
-    <!-- <script type="text/javascript" src="/static/lib/js/popper-1.16.0.min.js"></script> -->
-    <!-- <script type="text/javascript" src="/static-modules/bootstrap/dist/js/bootstrap.min.js"></script> -->
-    <script type="text/javascript" src="/static-modules/bootstrap/dist/js/bootstrap.bundle.min.js"></script>
-    <script type="text/javascript" src="/static-modules/@fortawesome/fontawesome-free/js/all.min.js"></script>
-    <script type="text/javascript" src='/static-modules/mustache/mustache.min.js'></script>
-    <script type="text/javascript" src='/static-modules/jq-repeat/dist/js/jq-repeat.js'></script>
-    <script type="text/javascript" src='/static/lib/js/val.js'></script>
-    <script type="text/javascript" src="/static-modules/moment/moment.js"></script>
-    <script type="text/javascript" src="/static/lib/js/app-base.js"></script>
-    <script type="text/javascript" src="/static/js/app.js"></script>
-  </head>
-  <body>
+		<link rel='stylesheet' href='/static/css/styles.css' />
+		<!-- Scripts are placed here -->
+		<script type="text/javascript" src="/socket.io/socket.io.js"></script>
+		<script type="text/javascript" src='/static-modules/jquery/dist/jquery.js'></script>
+		<script type="text/javascript" src="/static-modules/bootstrap/dist/js/bootstrap.bundle.min.js"></script>
+		<script type="text/javascript" src="/static-modules/@fortawesome/fontawesome-free/js/all.min.js"></script>
+		<script type="text/javascript" src='/static-modules/mustache/mustache.min.js'></script>
+		<script type="text/javascript" src='/static-modules/jq-repeat/dist/js/jq-repeat.js'></script>
+		<script type="text/javascript" src='/static/lib/js/val.js'></script>
+		<script type="text/javascript" src="/static-modules/moment/moment.js"></script>
+		<script type="text/javascript" src="/static/lib/js/app-base.js"></script>
+		<script type="text/javascript" src="/static/js/app.js"></script>
+	</head>
+	<body>
 
-  	<nav class="navbar navbar-expand-md navbar-dark fixed-top bg-dark">
-  	  <a class="navbar-brand" href="/"><img src="<%- logo %>" height="28" class="me-2" alt=""><%- name %> <%- titleIcon %></a>
-  	  <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navbarSupportedContent" aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
-  	    <span class="navbar-toggler-icon"></span>
-  	  </button>
-  	  <div class="collapse navbar-collapse justify-content-end" id="navbarSupportedContent">
-  	    <ul class="navbar-nav top-nav">
-  	      <li class="nav-item group-required group-required-app_sso_admin">
-  	        <a class="nav-link" href="/users"><i class="fa-solid fa-users"></i>
-  	          Users
-  	        </a>
-  	      </li>
-  	      <li class="nav-item group-required group-required-app_sso_admin">
-  	        <a class="nav-link" href="/groups"><i class="fa-solid fa-users-viewfinder"></i>
-  	          Groups
-  	        </a>
-  	      </li>
-  	      <li class="nav-item group-required group-required-app_sso_admin group-required-app_sso_directory_admin">
-  	        <a class="nav-link" href="/directory"><i class="fa-solid fa-server"></i>
-  	          Directory
-  	        </a>
-  	      </li>
+		<nav class="navbar navbar-expand-md navbar-dark fixed-top bg-dark">
+			<a class="navbar-brand" href="/"><img src="<%- logo %>" height="28" class="me-2" alt=""><%- name %> <%- titleIcon %></a>
+			<button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navbarSupportedContent" aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
+				<span class="navbar-toggler-icon"></span>
+			</button>
+			<div class="collapse navbar-collapse justify-content-end" id="navbarSupportedContent">
+				<ul class="navbar-nav top-nav">
+					<%# Items gated on a group start hidden (.group-required) and are
+					    revealed by app-base.js for the groups the user is in. %>
+					<% for(const item of ui.nav){ %>
+					<li class="nav-item<%- item.groups.length ? ' group-required' : '' %><%- item.groups.map(group => ' group-required-' + group).join('') %>">
+						<a class="nav-link" href="<%- item.href %>"><i class="<%- item.icon %>"></i>
+							<%- item.label %>
+						</a>
+					</li>
+					<% } %>
+				</ul>
+				<div class="form-inline mt-2 mt-md-0">
+					<% if(ui.profileUrl){ %>
+					<a id="cl-username" class="navbar-text text-light me-3" href="<%- ui.profileUrl %>" style="display: none;">
+						<i class="fa-solid fa-user me-1"></i><span id="cl-username-text"></span>
+					</a>
+					<% } else { %>
+					<span id="cl-username" class="navbar-text text-light me-3" style="display: none;">
+						<i class="fa-solid fa-user me-1"></i><span id="cl-username-text"></span>
+					</span>
+					<% } %>
+					<a id="cl-login-button" class="btn btn-outline-danger my-2 my-sm-0" onclick="app.auth.forceLogin()" style="display: none;">
+						<i class="fas fa-sign-in"></i>
+						Login
+					</a>
+
+					<button id="cl-logout-button" class="btn btn-outline-danger my-2 my-sm-0" onclick="app.auth.logOut(function(){ window.location.href = '<%- ui.logoutRedirect %>'; })" style="display: none;">
+						<i class="fas fa-sign-out"></i>
+						Log Out
+					</button>
+				</div>
+			</div>
+		</nav>
+
+		<% if(ui.updateCheck){ %>
+		<!-- Admin-only "a newer release is available" notice (services/update_check.js).
+		     Dismissal is per-browser-session only (sessionStorage), not persisted server-side.
+		     Fixed-positioned below the fixed navbar (a plain in-flow div here would render
+		     UNDER the nav, since fixed elements are taken out of document flow) -- shown/hidden
+		     dynamically, so #spa-shell's margin-top is adjusted in JS to make room for it. -->
+		<div id="update-banner" class="alert alert-info alert-dismissible mb-0 rounded-0 text-center" style="display:none; position:fixed; left:0; right:0; z-index:1029;">
+			<span id="update-banner-text"></span>
+			<button type="button" class="btn-close" onclick="dismissUpdateBanner()"></button>
+		</div>
+
+		<script type="text/javascript">
+			function showUpdateBanner(){
+				let $nav = $('nav.fixed-top');
+				let $banner = $('#update-banner');
+				$banner.css('top', $nav.outerHeight() + 'px').show();
+				$('#spa-shell').css('margin-top', ($nav.outerHeight() + $banner.outerHeight()) + 'px');
+			}
+
+			function dismissUpdateBanner(){
+				$('#update-banner').hide();
+				$('#spa-shell').css('margin-top', '');
+				sessionStorage.setItem('update-banner-dismissed', '1');
+			}
+
+			function checkForUpdate(){
+				if(sessionStorage.getItem('update-banner-dismissed')) return;
+				app.api.get('update-check', function(error, info){
+					if(error || !info || !info.updateAvailable) return;
+					$('#update-banner-text').html(
+						'A newer version of <%- ui.updateLabel %> is available: <b>v' + info.latestVersion + '</b> ' +
+						'(running v' + info.currentVersion + ') — ' +
+						'<a href="' + info.releaseUrl + '" target="_blank" class="alert-link">see what changed</a>.'
+					);
+					showUpdateBanner();
+				});
+			}
+		</script>
+		<% } %>
+
+		<script type="text/javascript">
+			$(document).ready(function(){
+
+				// Set the correct link to active in the top nav bar
+				$('.top-nav a').each(function(index){
+					let $this = $(this);
+					$this.removeClass('active');
+					if($this.attr('href').toLocaleLowerCase() === window.location.pathname.toLocaleLowerCase()){
+						$this.addClass('active')
+					}
+				})
+
+				// Set the correct login/logout button, and reveal the current user's
+				// name once we know who they are. Group-gated nav items are revealed
+				// by app-base.js off the same cached user/me.
+				app.auth.isLoggedIn(function(error, me){
+					if(me){
+						$('#cl-logout-button').show();
+						let username = me.uid || me.username;
+						if(username){
+							$('#cl-username-text').text(username);
+							$('#cl-username').css('display', '');
+						}
+
+						<% if(ui.updateCheck){ %>
+						if(me.isAdmin) checkForUpdate();
+						<% } %>
+					}else{
+						$('#cl-login-button').show();
+					}
+				});
+
+			});
+		</script>
 
 
-  	      <li class="nav-item group-required group-required-app_sso_admin">
-  	        <a class="nav-link" href="/executive">
-  	          <i class="fa-solid fa-gauge-high"></i>
-  	          Executive
-  	        </a>
-  	      </li>
-  	    </ul>
-  	    <div class="form-inline mt-2 mt-md-0">
-  	      <a id="cl-username" class="navbar-text text-light me-3" href="/profile" style="display: none;">
-  	        <i class="fa-solid fa-user me-1"></i><span id="cl-username-text"></span>
-  	      </a>
-  	      <a id="cl-login-button" class="btn btn-outline-danger my-2 my-sm-0" onclick="app.auth.forceLogin()" style="display: none;">
-  	        <i class="fas fa-sign-out"></i>
-  	        Login
-  	      </a>
-
-  	      <button id="cl-logout-button" class="btn btn-outline-danger my-2 my-sm-0" onclick="app.auth.logOut(e => window.location.href='/')" style="display: none;">
-  	        <i class="fas fa-sign-out"></i>
-  	        Log Out
-  	      </button>
-  	    </div>
-  	  </div>
-  	</nav>
-
-  	<div id="update-banner" class="alert alert-info alert-dismissible mb-0 rounded-0 text-center" style="display:none; position:fixed; left:0; right:0; z-index:1029;">
-  	  <span id="update-banner-text"></span>
-  	  <button type="button" class="btn-close" onclick="dismissUpdateBanner()"></button>
-  	</div>
-
-  	<script type="text/javascript">
-  	  function showUpdateBanner(){
-  	    let $nav = $('nav.fixed-top');
-  	    let $banner = $('#update-banner');
-  	    $banner.css('top', $nav.outerHeight() + 'px').show();
-  	    $('#spa-shell').css('margin-top', ($nav.outerHeight() + $banner.outerHeight()) + 'px');
-  	  }
-  	  function dismissUpdateBanner(){
-  	    $('#update-banner').hide();
-  	    $('#spa-shell').css('margin-top', '');
-  	    sessionStorage.setItem('update-banner-dismissed', '1');
-  	  }
-
-  	  $(document).ready(async function(){
-
-  	    // Set the correct link to active in the top nav bar
-  	    $('.top-nav a').each(function(index){
-  	      let $this = $(this);
-  	      $this.removeClass('active');
-  	      if($this.attr('href').toLocaleLowerCase() === window.location.pathname.toLocaleLowerCase()){
-  	        $this.addClass('active')
-  	      }
-  	    })
-
-  	    // Set the correct login/logout button, and reveal the current user's
-  	    // name (linking to their profile) once we know who they are.
-  	    var me = await app.auth.isLoggedIn();
-  	    if(me){
-  	      $('#cl-logout-button').show();
-  	      if(me.uid){
-  	        $('#cl-username-text').text(me.uid);
-  	        $('#cl-username').css('display', '');
-  	      }
-
-  	      if(await app.auth.memberOf('app_sso_admin', me) && !sessionStorage.getItem('update-banner-dismissed')){
-  	        app.api.get('update-check', function(error, info){
-  	          if(error || !info || !info.updateAvailable) return;
-  	          $('#update-banner-text').html(
-  	            'A newer version of SSO Manager is available: <b>v' + info.latestVersion + '</b> ' +
-  	            '(running v' + info.currentVersion + ') — ' +
-  	            '<a href="' + info.releaseUrl + '" target="_blank" class="alert-link">see what changed</a>.'
-  	          );
-  	          showUpdateBanner();
-  	        });
-  	      }
-  	    }else{
-  	      $('#cl-login-button').show();
-  	    }
-
-  	  });
-  	</script>
-
-
-  	<!-- Container -->
-  	<div id="spa-shell" class="container-fluid">
-      <div class="actionMessage" style="display:none;"></div>
+		<!-- Container -->
+		<div id="spa-shell" class="container-fluid">
+			<div class="actionMessage" style="display:none;"></div>