@frangoteam/fuxa-min 1.2.6 → 1.2.8

package/README.md

@@ -9,7 +9,7 @@ FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. With F
 ![fuxa action](/screenshot/feature-action-move.gif)
 
 ## Features
-- Devices connectivity with Modbus RTU/TCP, Siemens S7 Protocol, OPC-UA, BACnet IP, MQTT, WebAPI, Ethernet/IP (Allen Bradley), ODBC
+- Devices connectivity with Modbus RTU/TCP, Siemens S7 Protocol, OPC-UA, BACnet IP, MQTT, WebAPI, Ethernet/IP (Allen Bradley), ADSclient, Gpio (Raspberry), WebCam, MELSEC, ODBC, Redis
 - SCADA/HMI Web-Editor - Engineering and Design completely web-based
 - Cross-Platform Full-Stack - Backend with NodeJs and Frontend with Web technologies (HTML5, CSS, Javascript, Angular, SVG)
 

package/api/apikeys/index.js

@@ -0,0 +1,107 @@
+/**
+ * 'api/apikeys': ApiKeys API to GET/POST/DELETE apikeys
+ */
+
+var express = require("express");
+const authJwt = require('../jwt-helper');
+var runtime;
+var secureFnc;
+var checkGroupsFnc;
+
+module.exports = {
+    init: function (_runtime, _secureFnc, _checkGroupsFnc) {
+        runtime = _runtime;
+        secureFnc = _secureFnc;
+        checkGroupsFnc = _checkGroupsFnc;
+    },
+    app: function() {
+        var apiKeysApp = express();
+        apiKeysApp.use(function(req,res,next) {
+            if (!runtime.project) {
+                res.status(404).end();
+            } else {
+                next();
+            }
+        });
+
+        /**
+         * GET ApiKeys
+         * Take from ApiKeys storage and reply
+         */
+        apiKeysApp.get("/api/apikeys", secureFnc, function(req, res) {
+            const permission = checkGroupsFnc(req);
+            if (res.statusCode === 403) {
+                runtime.logger.error("api get apikeys: Tocken Expired");
+            } else if (!authJwt.haveAdminPermission(permission)) {
+                res.status(401).json({error:"unauthorized_error", message: "Unauthorized!"});
+                runtime.logger.error("api get apikeys: Unauthorized!");
+            } else {
+                runtime.apiKeys.getApiKeys(req.query).then(result => {
+                    if (result) {
+                        res.json(result);
+                    } else {
+                        res.end();
+                    }
+                }).catch(function(err) {
+                    if (err.code) {
+                        res.status(400).json({error:err.code, message: err.message});
+                    } else {
+                        res.status(400).json({error:"unexpected_error", message:err.toString()});
+                    }
+                    runtime.logger.error("api get apikeys: " + err.message);
+                });
+            }
+        });
+
+        /**
+         * POST ApiKeys
+         * Set apikeys storage
+         */
+        apiKeysApp.post("/api/apikeys", secureFnc, function(req, res, next) {
+            const permission = checkGroupsFnc(req);
+            if (res.statusCode === 403) {
+                runtime.logger.error("api post apikeys: Tocken Expired");
+            } else if (!authJwt.haveAdminPermission(permission)) {
+                res.status(401).json({error:"unauthorized_error", message: "Unauthorized!"});
+                runtime.logger.error("api post apikeys: Unauthorized");
+            } else {
+                runtime.apiKeys.setApiKeys(req.body.params).then(function(data) {
+                    res.end();
+                }).catch(function(err) {
+                    if (err.code) {
+                        res.status(400).json({error:err.code, message: err.message});
+                    } else {
+                        res.status(400).json({error:"unexpected_error", message:err.toString()});
+                    }
+                    runtime.logger.error("api post apikeys: " + err.message);
+                });
+            }
+        });
+
+        /**
+         * DELETE Roles
+         * Delete apikeys from storage
+         */
+        apiKeysApp.delete("/api/apikeys", secureFnc, function(req, res, next) {
+            const permission = checkGroupsFnc(req);
+            if (res.statusCode === 403) {
+                runtime.logger.error("api delete apikeys: Tocken Expired");
+            } else if (!authJwt.haveAdminPermission(permission)) {
+                res.status(401).json({error:"unauthorized_error", message: "Unauthorized!"});
+                runtime.logger.error("api delete apikeys: Unauthorized");
+            } else {
+                runtime.apiKeys.removeApiKeys(JSON.parse(req.query.apikeys)).then(function(data) {
+                    res.end();
+                }).catch(function(err) {
+                    if (err.code) {
+                        res.status(400).json({error:err.code, message: err.message});
+                    } else {
+                        res.status(400).json({error:"unexpected_error", message:err.toString()});
+                    }
+                    runtime.logger.error("api delete apikeys: " + err.message);
+                });
+            }
+        });
+        return apiKeysApp;
+    }
+}

package/api/apikeys/verify-api-or-token.js

@@ -0,0 +1,47 @@
+'use strict';
+
+const authJwt = require('../jwt-helper');
+
+/**
+ * Middleware that accepts either JWT (x-access-token) or API key (x-api-key).
+ * It is active only when security is enabled.
+ */
+module.exports = function verifyApiOrToken(runtime) {
+    return async function (req, res, next) {
+        if (!runtime?.settings?.secureEnabled) {
+            return next();
+        }
+
+        const apiKey = req.headers['x-api-key'];
+        if (apiKey) {
+            try {
+                const stored = await runtime.apiKeys.getApiKeys();
+                const now = Date.now();
+                const validKey = stored.find(k => {
+                    if (!k || k.key !== apiKey || k.enabled === false) {
+                        return false;
+                    }
+                    if (!k.expires) {
+                        return true;
+                    }
+                    const expiresAt = new Date(k.expires).getTime();
+                    return !isNaN(expiresAt) && expiresAt > now;
+                });
+
+                if (validKey) {
+                    req.apiKey = validKey;
+                    // Grant admin group to match existing authorization checks.
+                    req.userId = validKey.id || `apikey:${apiKey}`;
+                    req.userGroups = authJwt.adminGroups[0];
+                    return next();
+                }
+            } catch (err) {
+                runtime.logger.error(`api-key validation failed: ${err}`);
+                return res.status(500).json({ error: 'unexpected_error', message: 'ApiKey validation failed' });
+            }
+            return res.status(401).json({ error: 'unauthorized_error', message: 'Invalid API Key' });
+        }
+
+        return authJwt.verifyToken(req, res, next);
+    };
+};

package/api/index.js

@@ -12,15 +12,20 @@ const rateLimit = require("express-rate-limit");
 var prjApi = require('./projects');
 var authApi = require('./auth');
 var usersApi = require('./users');
+var apiKeysApi = require('./apikeys');
 var alarmsApi = require('./alarms');
 var pluginsApi = require('./plugins');
 var diagnoseApi = require('./diagnose');
 var scriptsApi = require('./scripts');
 var resourcesApi = require('./resources');
 var daqApi = require('./daq');
+var schedulerApi = require('./scheduler');
 var commandApi = require('./command');
 const reports = require('../dist/reports.service');
 const reportsApi = new reports.ReportsApiService();
+const verifyApiOrToken = require('./apikeys/verify-api-or-token');
+
+const version = '1.0.0';
 
 var apiApp;
 var server;
@@ -29,6 +34,7 @@ var runtime;
 function init(_server, _runtime) {
     server = _server;
     runtime = _runtime;
+
     return new Promise(function (resolve, reject) {
         if (runtime.settings.disableServer !== false) {
             apiApp = express();
@@ -39,28 +45,33 @@ function init(_server, _runtime) {
             apiApp.use(bodyParser.json({limit:maxApiRequestSize}));
             apiApp.use(bodyParser.urlencoded({limit:maxApiRequestSize, extended: true}));
             authJwt.init(runtime.settings.secureEnabled, runtime.settings.secretCode, runtime.settings.tokenExpiresIn);
-            prjApi.init(runtime, authJwt.verifyToken, verifyGroups);
+            const authMiddleware = verifyApiOrToken(runtime);
+            prjApi.init(runtime, authMiddleware, verifyGroups);
             apiApp.use(prjApi.app());
-            usersApi.init(runtime, authJwt.verifyToken, verifyGroups);
+            usersApi.init(runtime, authMiddleware, verifyGroups);
             apiApp.use(usersApi.app());
-            alarmsApi.init(runtime, authJwt.verifyToken, verifyGroups);
+            alarmsApi.init(runtime, authMiddleware, verifyGroups);
             apiApp.use(alarmsApi.app());
             authApi.init(runtime, authJwt.secretCode, authJwt.tokenExpiresIn);
             apiApp.use(authApi.app());
-            pluginsApi.init(runtime, authJwt.verifyToken, verifyGroups);
+            pluginsApi.init(runtime, authMiddleware, verifyGroups);
             apiApp.use(pluginsApi.app());
-            diagnoseApi.init(runtime, authJwt.verifyToken, verifyGroups);
+            diagnoseApi.init(runtime, authMiddleware, verifyGroups);
             apiApp.use(diagnoseApi.app());
-            daqApi.init(runtime, authJwt.verifyToken, verifyGroups);
+            daqApi.init(runtime, authMiddleware, verifyGroups);
             apiApp.use(daqApi.app());
-            scriptsApi.init(runtime, authJwt.verifyToken, verifyGroups);
+            schedulerApi.init(runtime, authMiddleware, verifyGroups);
+            apiApp.use(schedulerApi.app());
+            scriptsApi.init(runtime, authMiddleware, verifyGroups);
             apiApp.use(scriptsApi.app());
-            resourcesApi.init(runtime, authJwt.verifyToken, verifyGroups);
+            resourcesApi.init(runtime, authMiddleware, verifyGroups);
             apiApp.use(resourcesApi.app());
-            commandApi.init(runtime, authJwt.verifyToken, verifyGroups);
+            commandApi.init(runtime, authMiddleware, verifyGroups);
             apiApp.use(commandApi.app());
-            reportsApi.init(runtime, authJwt.verifyToken, verifyGroups);
+            reportsApi.init(runtime, authMiddleware, verifyGroups);
             apiApp.use(reportsApi.app());
+            apiKeysApi.init(runtime, authMiddleware, verifyGroups);
+            apiApp.use(apiKeysApi.app());
 
             const limiter = rateLimit({
                 windowMs: 5 * 60 * 1000, // 5 minutes
@@ -79,6 +90,13 @@ function init(_server, _runtime) {
                 next(err);
             });
 
+            /**
+             * GET Server setting data
+             */
+            apiApp.get('/api/version', function (req, res) {
+                res.json(version);
+            });
+
             /**
              * GET Server setting data
              */
@@ -101,7 +119,7 @@ function init(_server, _runtime) {
             /**
              * POST Server user settings
              */
-            apiApp.post("/api/settings", authJwt.verifyToken, function(req, res, next) {
+            apiApp.post("/api/settings", authMiddleware, function(req, res, next) {
                 const permission = verifyGroups(req);
                 if (res.statusCode === 403) {
                     runtime.logger.error("api post settings: Tocken Expired");
@@ -128,7 +146,7 @@ function init(_server, _runtime) {
             /**
              * GET Heartbeat to check token
              */
-            apiApp.post('/api/heartbeat', authJwt.verifyToken, function (req, res) {
+            apiApp.post('/api/heartbeat', authMiddleware, function (req, res) {
                 if (!runtime.settings.secureEnabled) {
                     res.end();
                 } else if (res.statusCode === 403) {
@@ -152,6 +170,7 @@ function init(_server, _runtime) {
                     res.end();
                 }
             });
+
             runtime.logger.info('api: init successful!', true);
         } else {
         }
@@ -179,10 +198,16 @@ function mergeUserSettings(settings) {
     if (settings.alarms) {
         runtime.settings.alarms = settings.alarms;
     }
+    if (settings.logs) {
+        runtime.settings.logs = settings.logs;
+    }
 }
 
 function verifyGroups(req) {
     if (runtime.settings && runtime.settings.secureEnabled) {
+        if (req.apiKey) {
+            return authJwt.adminGroups[0];
+        }
         if (req.tokenExpired) {
             return (runtime.settings.userRole) ? null : 0;
         }

package/api/jwt-helper.js

@@ -76,6 +76,51 @@ function verifyToken (req, res, next) {
     }
 }
 
+function requireAuth (req, res, next) {
+    // Allow requests from FUXA interface (iframe embedding)
+    // Check for common FUXA referer patterns
+    const referer = req.headers.referer;
+    if (referer) {
+        // Allow if referer is from the same host (to support IP access without specific paths)
+        const requestHost = req.headers.host;
+        if (referer.startsWith(`http://${requestHost}`) || referer.startsWith(`https://${requestHost}`)) {
+            return next();
+        }
+        // Allow if referer contains common FUXA paths or is from the same server
+        const fuxaPatterns = [
+            '/fuxa', '/editor', '/viewer', '/lab', '/home',
+            'localhost:', '127.0.0.1:', '0.0.0.0:'
+        ];
+        const hasFuxaReferer = fuxaPatterns.some(pattern => referer.includes(pattern));
+        if (hasFuxaReferer) {
+            return next();
+        }
+    }
+
+    // For direct access, require authentication
+    let token = req.headers['x-access-token'];
+
+    if (!token) {
+        return res.status(401).json({ error: "unauthorized_error", message: "Authentication required!" });
+    }
+
+    jwt.verify(token, secretCode, (err, decoded) => {
+        if (err) {
+            return res.status(401).json({ error: "unauthorized_error", message: "Invalid token!" });
+        } else {
+            req.userId = decoded.id;
+            req.userGroups = decoded.groups;
+            if (req.headers['x-auth-user']) {
+                let user = JSON.parse(req.headers['x-auth-user']);
+                if (user && user.groups != req.userGroups) {
+                    return res.status(403).json({ error: "unauthorized_error", message: "User Profile Corrupted!" });
+                }
+            }
+            next();
+        }
+    });
+}
+
 function getNewToken(headers) {
     const authUser = (headers['x-auth-user']) ? JSON.parse(headers['x-auth-user']) : null;
     if (authUser) {
@@ -119,6 +164,7 @@ module.exports = {
     init: init,
     verify: verify,
     verifyToken: verifyToken,
+    requireAuth: requireAuth,
     getNewToken: getNewToken,
     getGuestToken: getGuestToken,
     get secretCode() { return secretCode },

package/api/resources/index.js

@@ -7,6 +7,7 @@ const path = require('path');
 var express = require("express");
 const authJwt = require('../jwt-helper');
 const Report = require('../../runtime/jobs/report');
+const fontkit = require('fontkit');
 const os = require('os');
 
 var runtime;
@@ -41,16 +42,16 @@ module.exports = {
                 runtime.logger.error("api get resources/images: Unauthorized!");
             } else {
                 try {
-                    var result = {...req.query, ...{ groups: [] }};
+                    var result = { ...req.query, ...{ groups: [] } };
                     var resourcesDirs = getDirectories(runtime.settings.imagesFileDir);
                     for (var i = 0; i < resourcesDirs.length; i++) {
                         var group = { name: resourcesDirs[i], items: [] };
                         var dirPath = path.resolve(runtime.settings.imagesFileDir, resourcesDirs[i]);
-                        var wwwSubDir =  path.join('_images', resourcesDirs[i]);
-                        var files =  getFiles(dirPath, ['.jpg','.jpeg', '.png', '.gif', '.svg']);
+                        var wwwSubDir = path.join('_images', resourcesDirs[i]);
+                        var files = getFiles(dirPath, ['.jpg', '.jpeg', '.png', '.gif', '.svg', '.mp4', '.webm', '.ogg', '.ogv']);
                         for (var x = 0; x < files.length; x++) {
                             var filename = files[x].replace(/\.[^\/.]+$/, '');
-                            group.items.push({ path:  path.join(wwwSubDir, files[x]).split(path.sep).join(path.posix.sep), name: filename });
+                            group.items.push({ path: path.join(wwwSubDir, files[x]).split(path.sep).join(path.posix.sep), name: filename });
                         }
                         result.groups.push(group);
                     }
@@ -66,6 +67,74 @@ module.exports = {
             }
         });
 
+        /**
+         * GET Server resources folder content
+         */
+        resourcesApp.get('/api/resources/resources', secureFnc, function (req, res) {
+            try {
+                const resourcesFilter = { fonts: ['ttf'] };
+                const wwwSubDir = '_resources';
+                const result = { ...req.query, ...{ groups: [] } };
+                const group = { name: wwwSubDir, items: [] };
+                var files = getFiles(runtime.settings.resourcesFileDir, ['.jpg', '.jpeg', '.png', '.gif', '.svg', '.pdf', '.ttf', '.mp4', '.webm', '.ogg', '.ogv']);
+                for (var x = 0; x < files.length; x++) {
+                    const fileName = files[x];
+                    const filePath = path.join(wwwSubDir, files[x]).split(path.sep).join(path.posix.sep);
+                    var fileLabel;
+                    if (resourcesFilter.fonts.some(suffix => fileName.endsWith(suffix))) {
+                        const font = fontkit.openSync(filePath);
+                        fileLabel = font.fullName;
+                    }
+
+                    group.items.push({
+                        path: filePath,
+                        name: fileName,
+                        label: fileLabel
+                    });
+                }
+                result.groups.push(group);
+                res.json(result);
+            } catch (err) {
+                if (err.code) {
+                    res.status(400).json({ error: err.code, message: err.message });
+                } else {
+                    res.status(400).json({ error: "unexpected_error", message: err.toString() });
+                }
+                runtime.logger.error("api get resources/resources: " + err.message);
+            }
+        });
+
+        /**
+         * POST remove resource file
+         */
+        resourcesApp.post('/api/resources/remove', secureFnc, function (req, res) {
+            const permission = checkGroupsFnc(req);
+            if (res.statusCode === 403) {
+                runtime.logger.error("api post device: Tocken Expired");
+            } else if (!authJwt.haveAdminPermission(permission)) {
+                res.status(401).json({ error: "unauthorized_error", message: "Unauthorized!" });
+                runtime.logger.error("api post remove resource: Unauthorized");
+            } else {
+                try {
+                    let fileName = req.body.file.replace(new RegExp('../', 'g'), '');
+                    const filePath = path.join(runtime.settings.resourcesFileDir, fileName);
+                    if (fs.existsSync(filePath)) {
+                        fs.unlinkSync(filePath);
+                    }
+                    runtime.logger.info(`resources '${filePath}' deleted!`, true);
+                    res.end();
+                } catch (err) {
+                    if (err && err.code) {
+                        res.status(400).json({ error: err.code, message: err.message });
+                        runtime.logger.error("api remove resource: " + err.message);
+                    } else {
+                        res.status(400).json({ error: "unexpected_error", message: err });
+                        runtime.logger.error("api remove resource: " + err);
+                    }
+                }
+            }
+        });
+
         /**
          * GET svg/canvas rendered and converted to image
          */
@@ -102,8 +171,90 @@ module.exports = {
         });
 
         /**
-         * GET Server widgets folder content
+         * GET Templates
+         * Take from resources storage and reply
          */
+        resourcesApp.get("/api/resources/templates", secureFnc, function (req, res) {
+            const permission = checkGroupsFnc(req);
+            if (res.statusCode === 403) {
+                runtime.logger.error("api get templates: Tocken Expired");
+            } else if (!authJwt.haveAdminPermission(permission)) {
+                res.status(401).json({ error: "unauthorized_error", message: "Unauthorized!" });
+                runtime.logger.error("api get templates: Unauthorized!");
+            } else {
+                runtime.resourcesMgr.getTemplates(req.query).then(result => {
+                    // res.header("Access-Control-Allow-Origin", "*");
+                    // res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
+                    if (result) {
+                        result.forEach(template => {
+                            template.content = JSON.parse(template.content);
+                        });
+                        res.json(result);
+                    } else {
+                        res.end();
+                    }
+                }).catch(function (err) {
+                    if (err.code) {
+                        res.status(400).json({ error: err.code, message: err.message });
+                    } else {
+                        res.status(400).json({ error: "unexpected_error", message: err.toString() });
+                    }
+                    runtime.logger.error("api get templates: " + err.message);
+                });
+            }
+        });
+
+        /**
+         * POST template
+         */
+        resourcesApp.post('/api/resources/template', secureFnc, function (req, res) {
+            const permission = checkGroupsFnc(req);
+            if (res.statusCode === 403) {
+                runtime.logger.error("api post device: Tocken Expired");
+            } else if (!authJwt.haveAdminPermission(permission)) {
+                res.status(401).json({ error: "unauthorized_error", message: "Unauthorized!" });
+                runtime.logger.error("api post template: Unauthorized");
+            } else {
+                runtime.resourcesMgr.setTemplate(req.body.template).then((data) => {
+                    res.end();
+                }).catch(function (err) {
+                    if (err.code) {
+                        res.status(400).json({ error: err.code, message: err.message });
+                    } else {
+                        res.status(400).json({ error: "unexpected_error", message: err.toString() });
+                    }
+                    runtime.logger.error("api post template: " + err.message);
+                });
+            }
+        });
+
+        /**
+         * DELETE template
+         */
+        resourcesApp.delete("/api/resources/templates", secureFnc, function (req, res, next) {
+            const permission = checkGroupsFnc(req);
+            if (res.statusCode === 403) {
+                runtime.logger.error("api delete templates: Tocken Expired");
+            } else if (!authJwt.haveAdminPermission(permission)) {
+                res.status(401).json({ error: "unauthorized_error", message: "Unauthorized!" });
+                runtime.logger.error("api delete templates: Unauthorized");
+            } else {
+                runtime.resourcesMgr.removeTemplates(req.query.templates).then((data) => {
+                    res.end();
+                }).catch(function (err) {
+                    if (err.code) {
+                        res.status(400).json({ error: err.code, message: err.message });
+                    } else {
+                        res.status(400).json({ error: "unexpected_error", message: err.toString() });
+                    }
+                    runtime.logger.error("api delete templates: " + err.message);
+                });
+            }
+        });
+
+        /**
+        * GET Server widgets folder content
+        */
         resourcesApp.get('/api/resources/widgets', secureFnc, function (req, res) {
             const permission = checkGroupsFnc(req);
             if (res.statusCode === 403) {
@@ -113,16 +264,16 @@ module.exports = {
                 runtime.logger.error("api get resources/widgets: Unauthorized!");
             } else {
                 try {
-                    var result = {...req.query, ...{ groups: [] }};
+                    var result = { ...req.query, ...{ groups: [] } };
                     var resourcesDirs = getDirectories(runtime.settings.widgetsFileDir);
                     for (var i = 0; i < resourcesDirs.length; i++) {
                         var group = { name: resourcesDirs[i], items: [] };
                         var dirPath = path.resolve(runtime.settings.widgetsFileDir, resourcesDirs[i]);
-                        var wwwSubDir =  path.join('_widgets', resourcesDirs[i]);
-                        var files =  getFiles(dirPath, ['.svg']);
+                        var wwwSubDir = path.join('_widgets', resourcesDirs[i]);
+                        var files = getFiles(dirPath, ['.svg']);
                         for (var x = 0; x < files.length; x++) {
                             var filename = files[x];
-                            group.items.push({ path:  path.join(wwwSubDir, files[x]).split(path.sep).join(path.posix.sep), name: filename });
+                            group.items.push({ path: path.join(wwwSubDir, files[x]).split(path.sep).join(path.posix.sep), name: filename });
                         }
                         result.groups.push(group);
                     }
@@ -191,14 +342,14 @@ module.exports = {
     }
 }
 
-function getDirectories (pathDir) {
+function getDirectories(pathDir) {
     const directoriesInDIrectory = fs.readdirSync(pathDir, { withFileTypes: true })
         .filter((item) => item.isDirectory())
         .map((item) => item.name);
     return directoriesInDIrectory;
 }
 
-function getFiles (pathDir, extensions) {
+function getFiles(pathDir, extensions) {
     const filesInDIrectory = fs.readdirSync(pathDir)
         .filter((item) => extensions.indexOf(path.extname(item).toLowerCase()) !== -1);
     return filesInDIrectory;