wmantly
4a592f9795
Closes the end-user half of the directory and adds nested LDAP groups.
The directory could describe the lab but could not tell anyone what they had
or how to reach it, and several of the paths meant to do so were silently
returning nothing:
- GET /api/discovery/me resolved groups from req.user.groups, which does not
exist (req.user carries memberOf), so it returned only isPublic resources
for every human caller -- "My Services" was blank for everyone. The same
read made isDirectoryAdmin() false for real admins.
- The portal's "Discover More Services" called the admin-gated endpoint and
swallowed the 403, so it never rendered for non-admins at all.
- Services reported no address, because /me had reimplemented getMyAccess
without its parent-walking resolution.
Adds the catalog at /, self-service access requests, and admin access
visibility (per-resource counts, and the reverse "what can this user reach").
Nested groups come in two halves. groupOfNames.member already accepts a group
DN, so nesting needs no schema -- what it needs is resolution, which no
released OpenLDAP performs. The all-in-one image therefore builds slapd from a
pinned master commit for the nestgroup overlay, and the app computes the
closure itself when pointed at a server without it. Both paths are covered.
member-values is deliberately left out of nestgroup-flags: it expands `member`
when reading a group, which destroys the distinction between "listed here" and
"reachable through a nested group" and is not recoverable afterwards.
Full suite green in both resolution modes: 215 passed, 2 skipped.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
57 lines
2.2 KiB
JavaScript
57 lines
2.2 KiB
JavaScript
'use strict';
|
|
|
|
// Resolve a request user's LDAP group CNs.
|
|
//
|
|
// Why this exists: `req.user` is a `User.get()` result, which carries
|
|
// `memberOf` -- a list of full group DNs -- and has no `groups` property at
|
|
// all. Anything reading `req.user.groups` therefore silently sees an empty
|
|
// list rather than failing, which is how GET /api/discovery/me came to return
|
|
// only `isPublic` resources for every human caller, and how
|
|
// isDirectoryAdmin() came to be false even for real directory admins.
|
|
//
|
|
// routes/user.js:83 already derives the admin gate from `memberOf` the same
|
|
// way, so the overlay is known to be populated in production; the Group.list()
|
|
// fallback covers a user object assembled without it (and costs an LDAP round
|
|
// trip, so it is genuinely the fallback).
|
|
|
|
const { Group } = require('../models/group_ldap');
|
|
|
|
// 'cn=app_sso_admin,ou=groups,dc=example,dc=com' -> 'app_sso_admin'
|
|
function cnFromDn(dn) {
|
|
return String(dn).split(',')[0].replace(/^cn=/i, '');
|
|
}
|
|
|
|
async function groupCns(user) {
|
|
if (!user || user.isMachine) return [];
|
|
|
|
// Group.list(dn) resolves nested groups transitively. `memberOf` cannot: the
|
|
// memberof overlay records only direct membership, so a user who reaches a
|
|
// resource group through a nested group is absent from it entirely. That
|
|
// makes memberOf a fallback for when there is no DN to query with, never the
|
|
// preferred source -- reading it first would silently drop every nested grant.
|
|
if (user.dn) {
|
|
try {
|
|
return await Group.list(user.dn);
|
|
} catch (err) {
|
|
console.error(`groupCns: LDAP lookup failed for ${user.uid}:`, err.message);
|
|
}
|
|
}
|
|
|
|
if (Array.isArray(user.memberOf)) return user.memberOf.map(cnFromDn);
|
|
// memberOf is single-valued when the user is in exactly one group.
|
|
if (user.memberOf) return [cnFromDn(user.memberOf)];
|
|
|
|
return [];
|
|
}
|
|
|
|
// The shape @simpleworkjs/directory-schema's isDirectoryAdmin() expects: it
|
|
// matches against `.groups`, which the raw request user does not have.
|
|
async function withGroups(user) {
|
|
if (!user) return user;
|
|
return Object.assign(Object.create(Object.getPrototypeOf(user) || Object.prototype), user, {
|
|
groups: await groupCns(user),
|
|
});
|
|
}
|
|
|
|
module.exports = { groupCns, withGroups, cnFromDn };
|