1b-agent/dockhand-upstream
1
0 Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1.0.13

Browse Source
This commit is contained in:
jarek committed 2026-01-28 07:34:12 +01:00
1 parent a88d3d5788
commit 8f3a7eb435
96 files changed
+5235 -1870
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/routes/api/auth/ldap/+server.ts
+6 -1
View File
@@ -2,6 +2,7 @@ import { json } from '@sveltejs/kit';
import type { RequestHandler } from '@sveltejs/kit';
import { authorize } from '$lib/server/authorize';
import { getLdapConfigs, createLdapConfig } from '$lib/server/db';
import { auditLdapConfig } from '$lib/server/audit';
// GET /api/auth/ldap - List all LDAP configurations
export const GET: RequestHandler = async ({ cookies }) => {
@@ -31,7 +32,8 @@ export const GET: RequestHandler = async ({ cookies }) => {
};
// POST /api/auth/ldap - Create a new LDAP configuration
export const POST: RequestHandler = async ({ request, cookies }) => {
export const POST: RequestHandler = async (event) => {
const { request, cookies } = event;
const auth = await authorize(cookies);
// Allow access when auth is disabled (setup mode) or when user is admin
@@ -70,6 +72,9 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
tlsCa: data.tlsCa || undefined
});
// Audit log
await auditLdapConfig(event, 'create', config.id, config.name);
return json({
...config,
bindPassword: config.bindPassword ? '********' : undefined
src/routes/api/auth/ldap/[id]/+server.ts
+25 -4
View File
@@ -2,6 +2,8 @@ import { json } from '@sveltejs/kit';
import type { RequestHandler } from '@sveltejs/kit';
import { authorize } from '$lib/server/authorize';
import { getLdapConfig, updateLdapConfig, deleteLdapConfig } from '$lib/server/db';
import { auditLdapConfig } from '$lib/server/audit';
import { computeAuditDiff } from '$lib/utils/diff';
// GET /api/auth/ldap/[id] - Get a specific LDAP configuration
export const GET: RequestHandler = async ({ params, cookies }) => {
@@ -38,7 +40,8 @@ export const GET: RequestHandler = async ({ params, cookies }) => {
};
// PUT /api/auth/ldap/[id] - Update a LDAP configuration
export const PUT: RequestHandler = async ({ params, request, cookies }) => {
export const PUT: RequestHandler = async (event) => {
const { params, request, cookies } = event;
const auth = await authorize(cookies);
// Allow access when auth is disabled (setup mode) or when user is admin
@@ -89,6 +92,14 @@ export const PUT: RequestHandler = async ({ params, request, cookies }) => {
return json({ error: 'Failed to update configuration' }, { status: 500 });
}
// Compute diff for audit (exclude sensitive fields)
const diff = computeAuditDiff(existing, config, {
excludeFields: ['bindPassword', 'tlsCa', 'createdAt', 'updatedAt']
});
// Audit log
await auditLdapConfig(event, 'update', config.id, config.name, diff);
return json({
...config,
bindPassword: config.bindPassword ? '********' : undefined
@@ -100,7 +111,8 @@ export const PUT: RequestHandler = async ({ params, request, cookies }) => {
};
// DELETE /api/auth/ldap/[id] - Delete a LDAP configuration
export const DELETE: RequestHandler = async ({ params, cookies }) => {
export const DELETE: RequestHandler = async (event) => {
const { params, cookies } = event;
const auth = await authorize(cookies);
// Allow access when auth is disabled (setup mode) or when user is admin
@@ -118,11 +130,20 @@ export const DELETE: RequestHandler = async ({ params, cookies }) => {
}
try {
const deleted = await deleteLdapConfig(id);
if (!deleted) {
// Get config before deletion for audit
const config = await getLdapConfig(id);
if (!config) {
return json({ error: 'LDAP configuration not found' }, { status: 404 });
}
const deleted = await deleteLdapConfig(id);
if (!deleted) {
return json({ error: 'Failed to delete LDAP configuration' }, { status: 500 });
}
// Audit log
await auditLdapConfig(event, 'delete', id, config.name);
return json({ success: true });
} catch (error) {
console.error('Failed to delete LDAP config:', error);
src/routes/api/auth/login/+server.ts
+5
View File
@@ -41,6 +41,11 @@ export const POST: RequestHandler = async (event) => {
);
}
// Reject local login attempts when DISABLE_LOCAL_LOGIN is set
if (provider === 'local' && process.env.DISABLE_LOCAL_LOGIN === 'true') {
return json({ error: 'Local login is disabled' }, { status: 403 });
}
// Attempt authentication based on provider
let result: any;
let authProviderType: 'local' | 'ldap' | 'oidc' = 'local';
src/routes/api/auth/oidc/+server.ts
+6 -1
View File
@@ -6,6 +6,7 @@ import {
createOidcConfig,
type OidcConfig
} from '$lib/server/db';
import { auditOidcProvider } from '$lib/server/audit';
// GET /api/auth/oidc - List all OIDC configurations
export const GET: RequestHandler = async ({ cookies }) => {
@@ -36,7 +37,8 @@ export const GET: RequestHandler = async ({ cookies }) => {
};
// POST /api/auth/oidc - Create new OIDC configuration
export const POST: RequestHandler = async ({ request, cookies }) => {
export const POST: RequestHandler = async (event) => {
const { request, cookies } = event;
const auth = await authorize(cookies);
// When auth is enabled, require authentication and settings:edit permission
@@ -77,6 +79,9 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
roleMappings: data.roleMappings || undefined
});
// Audit log
await auditOidcProvider(event, 'create', config.id, config.name);
return json({
...config,
clientSecret: '********'
src/routes/api/auth/oidc/[id]/+server.ts
+25 -4
View File
@@ -6,6 +6,8 @@ import {
updateOidcConfig,
deleteOidcConfig
} from '$lib/server/db';
import { auditOidcProvider } from '$lib/server/audit';
import { computeAuditDiff } from '$lib/utils/diff';
// GET /api/auth/oidc/[id] - Get specific OIDC configuration
export const GET: RequestHandler = async ({ params, cookies }) => {
@@ -43,7 +45,8 @@ export const GET: RequestHandler = async ({ params, cookies }) => {
};
// PUT /api/auth/oidc/[id] - Update OIDC configuration
export const PUT: RequestHandler = async ({ params, request, cookies }) => {
export const PUT: RequestHandler = async (event) => {
const { params, request, cookies } = event;
const auth = await authorize(cookies);
// When auth is enabled, require authentication and settings:edit permission
@@ -93,6 +96,14 @@ export const PUT: RequestHandler = async ({ params, request, cookies }) => {
return json({ error: 'Failed to update OIDC configuration' }, { status: 500 });
}
// Compute diff for audit (exclude sensitive fields)
const diff = computeAuditDiff(existing, config, {
excludeFields: ['clientSecret', 'createdAt', 'updatedAt']
});
// Audit log
await auditOidcProvider(event, 'update', config.id, config.name, diff);
return json({
...config,
clientSecret: config.clientSecret ? '********' : ''
@@ -104,7 +115,8 @@ export const PUT: RequestHandler = async ({ params, request, cookies }) => {
};
// DELETE /api/auth/oidc/[id] - Delete OIDC configuration
export const DELETE: RequestHandler = async ({ params, cookies }) => {
export const DELETE: RequestHandler = async (event) => {
const { params, cookies } = event;
const auth = await authorize(cookies);
// When auth is enabled, require authentication and settings:edit permission
@@ -123,11 +135,20 @@ export const DELETE: RequestHandler = async ({ params, cookies }) => {
}
try {
const deleted = await deleteOidcConfig(id);
if (!deleted) {
// Get config before deletion for audit
const config = await getOidcConfig(id);
if (!config) {
return json({ error: 'OIDC configuration not found' }, { status: 404 });
}
const deleted = await deleteOidcConfig(id);
if (!deleted) {
return json({ error: 'Failed to delete OIDC configuration' }, { status: 500 });
}
// Audit log
await auditOidcProvider(event, 'delete', id, config.name);
return json({ success: true });
} catch (error) {
console.error('Failed to delete OIDC config:', error);
src/routes/api/auth/providers/+server.ts
+8 -3
View File
@@ -21,8 +21,10 @@ export const GET: RequestHandler = async () => {
const providers: { id: string; name: string; type: 'local' | 'ldap' | 'oidc'; initiateUrl?: string }[] = [];
// Local auth is always available when auth is enabled
providers.push({ id: 'local', name: 'Local', type: 'local' });
// Local auth is available unless DISABLE_LOCAL_LOGIN is set
if (process.env.DISABLE_LOCAL_LOGIN !== 'true') {
providers.push({ id: 'local', name: 'Local', type: 'local' });
}
// Add enabled LDAP providers (enterprise only)
for (const config of ldapConfigs) {
@@ -49,6 +51,9 @@ export const GET: RequestHandler = async () => {
});
} catch (error) {
console.error('Failed to get auth providers:', error);
return json({ providers: [{ id: 'local', name: 'Local', type: 'local' }] });
const fallbackProviders = process.env.DISABLE_LOCAL_LOGIN === 'true'
? []
: [{ id: 'local', name: 'Local', type: 'local' }];
return json({ providers: fallbackProviders });
}
};