wmantly
b91ef2792d
Personal access tokens so scripts/CI can call the management API without a browser session. Each logged-in user mints their own token; it authenticates as the creator (carries their LDAP group permissions, re-resolved live), so the existing permission.byGroup checks apply unchanged. - models/api_token.js: new ApiToken model (sso_<id>_<secret> format; id is the lookup key, secret bcrypt-hashed + isPrivate, shown once). add()/rotate()/ authenticate(); optional expires_at; best-effort last_used_on. No _ttl (persists; lifetime via expires_at). - routes/api_token.js: self-service CRUD (list/get/update/delete/rotate), owner-scoped (created_by === req.user.uid, 403 otherwise). - middleware/auth.js + models/auth.js: accept `Authorization: Bearer sso_...` (precedence over the auth-token session header); checkApiToken collapses every failure to one generic 401 (no existence/secret/expiry leak). - views/api_tokens.ejs + routes/index.js (GET /api-tokens): self-service page (forceLogin, no group gate) — create (token shown once), edit, rotate, revoke. - views/top.ejs: "API Tokens" nav entry visible to all logged-in users. - public/js/app.js: app.apiToken client module. - DEPLOYMENT.md + docs/deployment.md: API tokens section. Co-authored-by: Claude <noreply@anthropic.com>
103 lines
3.3 KiB
JavaScript
Executable File
103 lines
3.3 KiB
JavaScript
Executable File
'use strict';
|
|
|
|
const path = require('path');
|
|
const ejs = require('ejs')
|
|
const express = require('express');
|
|
|
|
// Set up the express app.
|
|
const app = express();
|
|
|
|
// Hold list of functions to run when the server is ready
|
|
app.onListen = [];
|
|
|
|
// Allow the express app to be exported into other files.
|
|
module.exports = app;
|
|
|
|
// Hold onto the auth middleware
|
|
const middleware = require('./middleware/auth');
|
|
|
|
// OAuth routes
|
|
const { router: oauthRouter, authRouter: oauthApiRouter, discovery } = require('./routes/oauth');
|
|
|
|
// Grab the projects PubSub
|
|
app.contoller = require('./controller');
|
|
|
|
// Push pubsub over the socket and back.
|
|
app.onListen.push(function(){
|
|
app.io.use(middleware.authIO);
|
|
|
|
app.contoller.ps.subscribe(/./g, function(data, topic){
|
|
app.io.emit('P2PSub', { topic, data });
|
|
});
|
|
|
|
app.io.on('connection', (socket) => {
|
|
// console.log('socket', socket)
|
|
var user = socket.user;
|
|
socket.on('P2PSub', (msg) => {
|
|
app.contoller.ps.publish(msg.topic, {...msg.data, __from:socket.user});
|
|
// socket.broadcast.emit('P2PSub', msg);
|
|
});
|
|
});
|
|
});
|
|
|
|
// load the JSON parser middleware. Express will parse JSON into native objects
|
|
// for any request that has JSON in its content type.
|
|
app.use(express.json());
|
|
app.set('trust proxy', 1);
|
|
|
|
// Set up the templating engine to build HTML for the front end.
|
|
app.set('views', path.join(__dirname, 'views'));
|
|
app.set('view engine', 'ejs');
|
|
|
|
// Have express server static content( images, CSS, browser JS) from the public
|
|
// local folder.
|
|
app.use('/static', express.static(path.join(__dirname, 'public')))
|
|
|
|
// Routes for front end content.
|
|
app.use('/', require('./routes/index'));
|
|
|
|
// API routes for authentication.
|
|
app.use('/api/auth', require('./routes/auth'));
|
|
|
|
// API routes for working with users. All endpoints need to be have valid user.
|
|
app.use('/api/user', middleware.auth, require('./routes/user'));
|
|
|
|
app.use('/api/token', middleware.auth, require('./routes/token'));
|
|
|
|
app.use('/api/group', middleware.auth, require('./routes/group'));
|
|
app.use('/api/notification', middleware.auth, require('./routes/notification'));
|
|
|
|
// Self-service API tokens (PATs) — owner-scoped, no admin group required.
|
|
app.use('/api/api-token', middleware.auth, require('./routes/api_token'));
|
|
|
|
// OAuth 2.0 / OpenID Connect
|
|
app.use('/oauth', oauthRouter);
|
|
app.use('/api/oauth/client', middleware.auth, require('./routes/oauth_client'));
|
|
app.use('/api/oauth', middleware.auth, oauthApiRouter);
|
|
app.get('/.well-known/openid-configuration', discovery);
|
|
|
|
|
|
// Catch 404 and forward to error handler. If none of the above routes are
|
|
// used, this is what will be called.
|
|
app.use(function(req, res, next) {
|
|
var err = new Error('Not Found');
|
|
err.message = 'Page not found'
|
|
err.status = 404;
|
|
next(err);
|
|
});
|
|
|
|
// Error handler. This is where `next()` will go on error
|
|
app.use(function(err, req, res, next) {
|
|
const SILENT_404S = ['/.well-known/'];
|
|
const isSilent404 = err.status === 404 && SILENT_404S.some(p => req.url.startsWith(p));
|
|
if (!isSilent404) console.error(err.status || res.status, err.name, req.method, req.url);
|
|
if(![401, 404].includes(err.status || res.status)){
|
|
console.error(err.message);
|
|
console.error(err.stack);
|
|
console.error('=========================================');
|
|
}
|
|
|
|
res.status(err.status || 500);
|
|
res.json({name: err.name, message: err.message});
|
|
});
|