Paddy
3ea9e630ed
Prep PR for the admin auth module (docs/plan-admin-auth.md step 1).
better-auth 1.7 ships ESM only, so the API moves off CommonJS:
- "type": "module", module nodenext, target ES2024, .js suffixes on all
relative imports, require('mariadb'|'cors') replaced by imports, and
export= packages (winston, app-root-path, bcrypt) consumed via default
imports. The logger now uses appRoot.path explicitly.
- TypeScript 5.9, @types/node 26, tslint removed. Node 26 pinned via
engines and .nvmrc (Plesk runs 26).
- Jest 28 + ts-jest replaced by vitest 5. Eight test files depend on
hoisted module mocks with static imports and resetModules + require,
which Jest's ESM mode does not support; vitest keeps them nearly
verbatim. Coverage via @vitest/coverage-v8 (lcov), Sonar generic report
via vitest-sonar-reporter, so sonar-project.properties is unchanged.
vitest.config.ts sets FEEDBACK_IP_SALT so the suite passes without a
local .env.
- dotenv 8 -> 16 and axios 0.24 -> 1.x: their old typings are not
resolvable under nodenext.
- autoCommit: false dropped from the pool configs; it is not a mariadb
connector option and was silently ignored.
tsc clean, 96/96 tests green, compiled app boots and serves /, /docs and
CORS under Node ESM.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
79 lines
2.8 KiB
TypeScript
79 lines
2.8 KiB
TypeScript
import express from 'express';
|
|
import * as UserService from '../calendar/users/users.service.js';
|
|
import {sendServerError} from './feedback.errors.js';
|
|
|
|
/**
|
|
* This file is the ONLY place in the feedback module that knows how admin
|
|
* authentication works today. No route handler and no service outside this
|
|
* file may import users.service, read session headers, or touch bcrypt.
|
|
*
|
|
* Today: reuses the existing Calendar users/sessions mechanism. Any
|
|
* activated @nachklang.art account may administer feedback — no roles.
|
|
* Migrating to Keycloak later means writing a keycloakJwtAuthenticator
|
|
* below and changing the one `activeAuthenticator` binding (plus the
|
|
* frontend's login route handler) — nothing else in the feedback module
|
|
* needs to change.
|
|
*
|
|
* Explicitly forbidden: accepting sessionId/sessionKey from query
|
|
* parameters, even "temporarily". That is the exact mistake documented in
|
|
* DEFERRED_SECURITY.md item 1 for the Calendar domain, where credentials
|
|
* end up in access logs, browser history, proxy logs, and Referer headers.
|
|
* Headers only.
|
|
*/
|
|
|
|
// The only thing the rest of the feedback module knows about an admin.
|
|
export interface AdminIdentity {
|
|
id: string;
|
|
email: string;
|
|
displayName: string;
|
|
}
|
|
|
|
// Pluggable strategy: extract + verify credentials from a request.
|
|
// Returns the identity, or null if unauthenticated. Throws only on
|
|
// infrastructure errors (e.g. the DB being unreachable).
|
|
export type AdminAuthenticator = (req: express.Request) => Promise<AdminIdentity | null>;
|
|
|
|
// Current implementation: reads X-Session-Id / X-Session-Key headers,
|
|
// delegates to the existing calendar UserService.checkSession(...).
|
|
export const sessionHeaderAuthenticator: AdminAuthenticator = async (req) => {
|
|
const sessionId = req.header('X-Session-Id');
|
|
const sessionKey = req.header('X-Session-Key');
|
|
if (!sessionId || !sessionKey) {
|
|
return null;
|
|
}
|
|
|
|
const ip = req.ip || '';
|
|
const user = await UserService.checkSession(sessionId, sessionKey, ip);
|
|
|
|
// Mirrors the Calendar domain's own convention: a valid session on an
|
|
// inactive (not yet activated) account is not sufficient.
|
|
if (!user || !user.isActive) {
|
|
return null;
|
|
}
|
|
|
|
return {
|
|
id: String(user.userId),
|
|
email: user.email,
|
|
displayName: user.fullName
|
|
};
|
|
};
|
|
|
|
// Swap point: change this one binding to migrate to Keycloak.
|
|
export const activeAuthenticator: AdminAuthenticator = sessionHeaderAuthenticator;
|
|
|
|
// Express middleware used by every admin route. On success:
|
|
// res.locals.admin = AdminIdentity, calls next(). On failure: 401.
|
|
export const requireAdminAuth: express.RequestHandler = async (req, res, next) => {
|
|
try {
|
|
const identity = await activeAuthenticator(req);
|
|
if (!identity) {
|
|
res.status(401).send({status: 'UNAUTHORIZED', message: 'Anmeldung erforderlich.'});
|
|
return;
|
|
}
|
|
res.locals.admin = identity;
|
|
next();
|
|
} catch (e: any) {
|
|
sendServerError(res, e);
|
|
}
|
|
};
|