wmantly
b91ef2792d
Personal access tokens so scripts/CI can call the management API without a browser session. Each logged-in user mints their own token; it authenticates as the creator (carries their LDAP group permissions, re-resolved live), so the existing permission.byGroup checks apply unchanged. - models/api_token.js: new ApiToken model (sso_<id>_<secret> format; id is the lookup key, secret bcrypt-hashed + isPrivate, shown once). add()/rotate()/ authenticate(); optional expires_at; best-effort last_used_on. No _ttl (persists; lifetime via expires_at). - routes/api_token.js: self-service CRUD (list/get/update/delete/rotate), owner-scoped (created_by === req.user.uid, 403 otherwise). - middleware/auth.js + models/auth.js: accept `Authorization: Bearer sso_...` (precedence over the auth-token session header); checkApiToken collapses every failure to one generic 401 (no existence/secret/expiry leak). - views/api_tokens.ejs + routes/index.js (GET /api-tokens): self-service page (forceLogin, no group gate) — create (token shown once), edit, rotate, revoke. - views/top.ejs: "API Tokens" nav entry visible to all logged-in users. - public/js/app.js: app.apiToken client module. - DEPLOYMENT.md + docs/deployment.md: API tokens section. Co-authored-by: Claude <noreply@anthropic.com>
68 lines
1.6 KiB
JavaScript
68 lines
1.6 KiB
JavaScript
'use strict';
|
|
|
|
const {User} = require('./user');
|
|
const {Token, AuthToken} = require('./token');
|
|
const {ApiToken} = require('./api_token');
|
|
|
|
var Auth = {}
|
|
Auth.errors = {}
|
|
|
|
Auth.errors.login = function(){
|
|
let error = new Error('LDAPLoginFailed');
|
|
error.name = 'LDAPLoginFailed';
|
|
error.message = `Invalid Credentials, login failed.`;
|
|
error.status = 401;
|
|
|
|
return error;
|
|
}
|
|
|
|
Auth.login = async function(data){
|
|
try{
|
|
let user = await User.login(data);
|
|
let token = await AuthToken.create(user);
|
|
|
|
return {user, token}
|
|
}catch(error){
|
|
console.error("AUTH LOGIN error:", error);
|
|
throw this.errors.login();
|
|
}
|
|
};
|
|
|
|
|
|
Auth.checkToken = async function(data){
|
|
try{
|
|
let token = await AuthToken.get(data);
|
|
if(token.is_valid){
|
|
return await User.get(token.created_by);
|
|
}
|
|
throw new Error('invalid token');
|
|
}catch(error){
|
|
throw this.errors.login();
|
|
}
|
|
};
|
|
|
|
// Validate an `Authorization: Bearer sso_<id>_<secret>` API token and return the
|
|
// owning user (same shape as checkToken). Every failure collapses to the same
|
|
// generic login 401 — no leak of whether the token existed vs. wrong secret vs.
|
|
// expired. The token authenticates AS its creator; permissions are re-resolved
|
|
// from LDAP live (permission.byGroup), so no groups snapshot is stored.
|
|
Auth.checkApiToken = async function(raw){
|
|
try{
|
|
let token = await ApiToken.authenticate(raw);
|
|
return await User.get(token.created_by);
|
|
}catch(error){
|
|
throw this.errors.login();
|
|
}
|
|
};
|
|
|
|
Auth.logOut = async function(data){
|
|
try{
|
|
let token = await AuthToken.get(data);
|
|
await token.remove();
|
|
}catch(error){
|
|
throw error;
|
|
}
|
|
}
|
|
|
|
module.exports = {Auth, AuthToken};
|