wmantly
181ca8c9cb
See CHANGELOG.md for the full breakdown. Summary:
- POST /api/v1/ldap/{bind,search}: LDAP-over-HTTPS so a client stops
speaking raw LDAP and instead calls the SSO, which binds/searches its
own OpenLDAP on the caller's behalf (DESIGN.md §3).
- LDAP byte-pump relay (utils/ldap_tunnel.js): forwards raw LDAP bytes
from an agent's local socket into OpenLDAP over the existing agent WSS
channel; the SSO never parses LDAP (DESIGN.md §4).
- POST /api/v1/agent/secrets: node-scoped OpenBao secret fetch for
agents, enforced to each agent's own secret/data/nodes/<id>/* prefix
(DESIGN.md §5).
- iam_apply signed command: push node-scoped IAM config (sudo rules, SSH
keys, access control, revocation) to an agent (DESIGN.md §6).
- Agent capability badges on the Directory Metrics tab, sourced from the
agent's own discovery frame.
- Join key management: GET /api/agent/join-keys/:id/agents (which hosts
enrolled through a key) plus a Manage join keys table in the Install
Agent modal with Revoke/Delete actions, confirmed inline per-row rather
than a blocking native confirm() or the shared app.messages.confirm()
banner (which desyncs across concurrent rows -- see CHANGELOG).
- docs/agents.md: capability matrix updated for the three new
capabilities, a full secrets-engine walkthrough with screenshots
(bash + Node consuming a rendered secret, plus the direct-API
alternative), and the join-key reuse/UI/audit questions answered.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
27 lines
840 B
JavaScript
27 lines
840 B
JavaScript
'use strict';
|
|
|
|
// Authenticate an agent from a Bearer token (the same token the agent presents
|
|
// on its WSS channel). Used by agent-facing REST endpoints (secrets, IAM) that
|
|
// are NOT admin-gated — the caller is the agent itself, not an admin session.
|
|
|
|
const { Agent } = require('../models/agent');
|
|
|
|
// Resolve a Bearer token to its (non-revoked) Agent, or null. Every failure
|
|
// collapses to null so a probing caller learns nothing about which part was
|
|
// wrong.
|
|
async function authenticateAgent(req) {
|
|
const auth = req.headers['authorization'] || '';
|
|
const m = /^Bearer\s+(.+)$/i.exec(auth);
|
|
if (!m) return null;
|
|
const token = String(m[1]).trim();
|
|
if (!token) return null;
|
|
try {
|
|
const agent = await Agent.authenticate(token);
|
|
return agent || null;
|
|
} catch (_) {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
module.exports = { authenticateAgent };
|