@intranefr/superbackend 1.5.2 → 1.6.3

package/src/admin/endpointRegistry.js

@@ -415,6 +415,74 @@ const endpointRegistry = [
       },
     ],
   },
+  {
+    id: "open-registry",
+    title: "Open Registry",
+    endpoints: [
+      {
+        id: "registry-auth",
+        method: "GET",
+        path: "/registry/plugins/auth",
+        auth: "none|bearer",
+      },
+      {
+        id: "registry-list",
+        method: "GET",
+        path: "/registry/plugins/list?category=plugins&minimal=true",
+        auth: "none|bearer",
+      },
+      {
+        id: "admin-registries-list",
+        method: "GET",
+        path: "/api/admin/registries",
+        auth: "basic",
+      },
+      {
+        id: "admin-registries-create",
+        method: "POST",
+        path: "/api/admin/registries",
+        auth: "basic",
+        bodyExample: { id: "plugins", name: "Plugins Registry", public: true, categories: ["plugins"] },
+      },
+      {
+        id: "admin-registry-item-upsert",
+        method: "POST",
+        path: "/api/admin/registries/plugins/items",
+        auth: "basic",
+        bodyExample: { id: "hello-cli", name: "hello-cli", category: "plugins", version: 1, versions: [1], description: "Sample" },
+      },
+    ],
+  },
+  {
+    id: "plugins-system",
+    title: "Plugins System",
+    endpoints: [
+      {
+        id: "plugins-list",
+        method: "GET",
+        path: "/api/admin/plugins",
+        auth: "basic",
+      },
+      {
+        id: "plugins-enable",
+        method: "POST",
+        path: "/api/admin/plugins/:id/enable",
+        auth: "basic",
+      },
+      {
+        id: "plugins-disable",
+        method: "POST",
+        path: "/api/admin/plugins/:id/disable",
+        auth: "basic",
+      },
+      {
+        id: "plugins-install",
+        method: "POST",
+        path: "/api/admin/plugins/:id/install",
+        auth: "basic",
+      },
+    ],
+  },
 ];
 
 module.exports = endpointRegistry;

package/src/controllers/admin.controller.js

@@ -7,6 +7,8 @@ const Notification = require('../models/Notification');
 const Invite = require('../models/Invite');
 const EmailLog = require('../models/EmailLog');
 const FormSubmission = require('../models/FormSubmission');
+const RbacRole = require('../models/RbacRole');
+const RbacUserRole = require('../models/RbacUserRole');
 const asyncHandler = require('../utils/asyncHandler');
 const fs = require('fs');
 const path = require('path');
@@ -56,10 +58,6 @@ const registerUser = asyncHandler(async (req, res) => {
     return res.status(400).json({ error: 'Password must be at least 6 characters' });
   }
 
-  if (!['user', 'admin'].includes(role)) {
-    return res.status(400).json({ error: 'Role must be either "user" or "admin"' });
-  }
-
   const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
   if (!emailRegex.test(email)) {
     return res.status(400).json({ error: 'Invalid email format' });
@@ -76,11 +74,33 @@ const registerUser = asyncHandler(async (req, res) => {
     email: email.toLowerCase(),
     passwordHash: password, // Will be hashed by pre-save hook
     name: name || '',
-    role: role
+    role: role // Keep for backward compatibility
   });
 
   await user.save();
 
+  // Assign RBAC role if it's not 'user'
+  if (role !== 'user') {
+    try {
+      // Find the RBAC role
+      const rbacRole = await RbacRole.findOne({ key: role, status: 'active' });
+      if (rbacRole) {
+        // Create user-role assignment
+        const userRoleAssignment = new RbacUserRole({
+          userId: user._id,
+          roleId: rbacRole._id
+        });
+        await userRoleAssignment.save();
+        console.log(`Assigned RBAC role '${role}' to user ${user.email}`);
+      } else {
+        console.warn(`RBAC role '${role}' not found, user created without RBAC role assignment`);
+      }
+    } catch (error) {
+      console.error('Error assigning RBAC role:', error);
+      // Don't fail the user creation if RBAC assignment fails
+    }
+  }
+
   // Log the admin action
   console.log(`Admin registered new user: ${user.email} with role: ${user.role}`);
 
@@ -352,7 +372,7 @@ const getWebhookStats = asyncHandler(async (req, res) => {
 const provisionCoolifyDeploy = asyncHandler(async (req, res) => {
   try {
     const { overwrite } = req.body;
-    const managePath = path.join(process.cwd(), "manage.sh");
+    const managePath = path.join(process.cwd(), "manage.js");
     const exists = fs.existsSync(managePath);
 
     if (exists && !overwrite) {
@@ -363,13 +383,19 @@ const provisionCoolifyDeploy = asyncHandler(async (req, res) => {
       });
     }
 
-    // In ref-superbackend, manage.sh already exists in the root of the repository
-    // If it didn't, we would write it here. For this case, we'll just success.
+    // Copy the improved manage.js from polybot
+    const sourceManageJs = path.join(__dirname, "../../../manage.js");
+    if (fs.existsSync(sourceManageJs)) {
+      fs.copyFileSync(sourceManageJs, managePath);
+      // Make it executable
+      fs.chmodSync(managePath, '755');
+    }
+
     res.json({
       success: true,
       message: exists
-        ? "Coolify Headless Deploy script (manage.sh) was already there."
-        : "Coolify Headless Deploy script (manage.sh) is ready in the root directory.",
+        ? "Coolify Headless Deploy script (manage.js) was updated."
+        : "Coolify Headless Deploy script (manage.js) is ready in the root directory.",
       path: managePath,
     });
   } catch (error) {

package/src/controllers/adminAgents.controller.js

@@ -0,0 +1,37 @@
+const Agent = require('../models/Agent');
+
+exports.listAgents = async (req, res) => {
+  try {
+    const agents = await Agent.find().lean();
+    return res.json({ items: agents });
+  } catch (error) {
+    return res.status(500).json({ error: error.message });
+  }
+};
+
+exports.createAgent = async (req, res) => {
+  try {
+    const agent = await Agent.create(req.body);
+    return res.json(agent);
+  } catch (error) {
+    return res.status(500).json({ error: error.message });
+  }
+};
+
+exports.updateAgent = async (req, res) => {
+  try {
+    const agent = await Agent.findByIdAndUpdate(req.params.id, req.body, { new: true });
+    return res.json(agent);
+  } catch (error) {
+    return res.status(500).json({ error: error.message });
+  }
+};
+
+exports.deleteAgent = async (req, res) => {
+  try {
+    await Agent.findByIdAndDelete(req.params.id);
+    return res.json({ success: true });
+  } catch (error) {
+    return res.status(500).json({ error: error.message });
+  }
+};

package/src/controllers/adminDataCleanup.controller.js

@@ -0,0 +1,45 @@
+const dataCleanup = require('../services/dataCleanup.service');
+
+exports.getOverview = async (req, res) => {
+  try {
+    const data = await dataCleanup.getOverviewStats();
+    return res.json(data);
+  } catch (err) {
+    const safe = dataCleanup.toSafeJsonError(err);
+    return res.status(safe.status).json(safe.body);
+  }
+};
+
+exports.dryRun = async (req, res) => {
+  try {
+    const out = await dataCleanup.dryRunCollectionCleanup(req.body || {});
+    return res.json(out);
+  } catch (err) {
+    const safe = dataCleanup.toSafeJsonError(err);
+    return res.status(safe.status).json(safe.body);
+  }
+};
+
+exports.execute = async (req, res) => {
+  try {
+    const out = await dataCleanup.executeCollectionCleanup(req.body || {});
+    return res.json(out);
+  } catch (err) {
+    const safe = dataCleanup.toSafeJsonError(err);
+    return res.status(safe.status).json(safe.body);
+  }
+};
+
+exports.inferFields = async (req, res) => {
+  try {
+    const { collection } = req.query;
+    if (!collection) {
+      return res.status(400).json({ error: 'collection query parameter is required' });
+    }
+    const fields = await dataCleanup.inferCollectionFields(collection);
+    return res.json({ fields });
+  } catch (err) {
+    const safe = dataCleanup.toSafeJsonError(err);
+    return res.status(safe.status).json(safe.body);
+  }
+};

package/src/controllers/adminLlm.controller.js

@@ -43,10 +43,6 @@ async function setStringSetting(key, value, description) {
     await existing.save();
     return existing;
   }
-  // Ensure we never create a document with an undefined value
-  if (stringValue === undefined) {
-    throw new Error(`Cannot save GlobalSetting with undefined value for key: ${key}`);
-  }
   const created = new GlobalSetting({
     key,
     value: stringValue,
@@ -79,10 +75,6 @@ async function setJsonSetting(key, value) {
     await existing.save();
     return existing;
   }
-  // Ensure we never create a document with an empty value
-  if (!stringValue) {
-    throw new Error(`Cannot save GlobalSetting with empty value for key: ${key}`);
-  }
   const created = new GlobalSetting({
     key,
     value: stringValue,
@@ -387,6 +379,24 @@ async function listCosts(req, res) {
   }
 }
 
+async function listProviders(req, res) {
+  try {
+    const providers = await getJsonSetting(PROVIDERS_KEY, {});
+    const safeProviders = {};
+    if (providers && typeof providers === "object") {
+      for (const [key, value] of Object.entries(providers)) {
+        if (!value || typeof value !== "object") continue;
+        const { apiKey, ...rest } = value;
+        safeProviders[key] = rest;
+      }
+    }
+    res.json({ providers: safeProviders });
+  } catch (error) {
+    console.error("[adminLlm] listProviders error", error);
+    res.status(500).json({ error: "Failed to load providers" });
+  }
+}
+
 module.exports = {
   getConfig,
   saveConfig,
@@ -394,4 +404,5 @@ module.exports = {
   listAudit,
   listCosts,
   listOpenRouterModels,
+  listProviders,
 };

package/src/controllers/adminLogin.controller.js

@@ -0,0 +1,269 @@
+const User = require('../models/User');
+const asyncHandler = require('../utils/asyncHandler');
+const rbacService = require('../services/rbac.service');
+
+/**
+ * Auto-detect authentication type based on identifier format
+ * @param {string} identifier - Email or username
+ * @returns {string} 'iam' for email format, 'basic' for username format
+ */
+function detectAuthType(identifier) {
+  return identifier.includes('@') ? 'iam' : 'basic';
+}
+
+/**
+ * Validate basic auth credentials against environment variables
+ * @param {string} username 
+ * @param {string} password 
+ * @returns {boolean} true if credentials are valid
+ */
+function validateBasicAuth(username, password) {
+  const adminUsername = process.env.ADMIN_USERNAME || "admin";
+  const adminPassword = process.env.ADMIN_PASSWORD || "admin";
+  
+  return username === adminUsername && password === adminPassword;
+}
+
+/**
+ * Serve the admin login page
+ */
+const getLogin = asyncHandler(async (req, res) => {
+  // If already authenticated, redirect to admin dashboard
+  if (req.session && req.session.authenticated) {
+    return res.redirect(req.adminPath || '/admin');
+  }
+
+  const templatePath = require('path').join(__dirname, '..', '..', 'views', 'admin-login.ejs');
+  const fs = require('fs');
+  const ejs = require('ejs');
+
+  fs.readFile(templatePath, 'utf8', (err, template) => {
+    if (err) {
+      console.error('Error reading login template:', err);
+      return res.status(500).send('Error loading login page');
+    }
+
+    try {
+      const html = ejs.render(template, {
+        baseUrl: req.baseUrl,
+        adminPath: req.adminPath || '/admin',
+        error: req.query.error || null,
+        success: req.query.success || null
+      }, {
+        filename: templatePath
+      });
+      res.send(html);
+    } catch (renderErr) {
+      console.error('Error rendering login template:', renderErr);
+      res.status(500).send('Error rendering login page');
+    }
+  });
+});
+
+/**
+ * Process login credentials (supports both basic auth and IAM)
+ */
+const postLogin = asyncHandler(async (req, res) => {
+  const { identifier, password } = req.body;
+
+  if (!identifier || !password) {
+    return res.redirect(`${req.adminPath || '/admin'}/login?error=Email/username and password are required`);
+  }
+
+  const authType = detectAuthType(identifier);
+  let user = null;
+  let authData = {};
+
+  try {
+    if (authType === 'iam') {
+      // IAM authentication - validate against User model
+      user = await User.findOne({ email: identifier.toLowerCase() });
+      
+      if (!user) {
+        return res.redirect(`${req.adminPath || '/admin'}/login?error=Invalid credentials`);
+      }
+
+      // Check RBAC permissions for admin panel access with backward compatibility
+      const RbacUserRole = require('../models/RbacUserRole');
+      const RbacRole = require('../models/RbacRole');
+      const RbacGrant = require('../models/RbacGrant');
+      const { matches } = require('../utils/rbac/engine');
+      
+      let hasAdminAccess = false;
+      
+      // Phase 1: Try RBAC assignment with pattern matching
+      const userRoleAssignment = await RbacUserRole.findOne({ userId: user._id });
+      if (userRoleAssignment) {
+        const userRole = await RbacRole.findById(userRoleAssignment.roleId);
+        if (userRole && userRole.status === 'active') {
+          // Get all grants for this role
+          const grants = await RbacGrant.find({
+            subjectType: 'role',
+            subjectId: userRole._id,
+            scopeType: 'global',
+            effect: 'allow'
+          });
+          
+          // Check if any grant matches admin_panel__login using pattern matching
+          hasAdminAccess = grants.some(grant => 
+            matches('admin_panel__login', grant.right)
+          );
+          
+          console.log(`RBAC check for user ${user.email}: role=${userRole.key}, grants=${grants.length}, hasAccess=${hasAdminAccess}`);
+        }
+      }
+      
+      // Phase 2: Fallback to IAM role for backward compatibility
+      if (!hasAdminAccess && ['admin', 'superadmin'].includes(user.role)) {
+        console.log(`Fallback to IAM role for user ${user.email}: role=${user.role}`);
+        hasAdminAccess = true; // Admin and superadmin roles get panel access
+      }
+      
+      if (!hasAdminAccess) {
+        return res.redirect(`${req.adminPath || '/admin'}/login?error=Insufficient permissions - Admin panel access required`);
+      }
+
+      // Validate password
+      const isMatch = await user.comparePassword(password);
+      if (!isMatch) {
+        return res.redirect(`${req.adminPath || '/admin'}/login?error=Invalid credentials`);
+      }
+
+      // Get user's RBAC roles for session data
+      let rbacRoles = [];
+      try {
+        // Get role information directly
+        if (userRoleAssignment) {
+          const userRole = await RbacRole.findById(userRoleAssignment.roleId);
+          if (userRole) {
+            rbacRoles = [{
+              roleId: userRole._id,
+              roleKey: userRole.key,
+              roleName: userRole.name,
+              grants: [] // We could populate this if needed
+            }];
+          }
+        }
+      } catch (error) {
+        console.error('Error fetching RBAC roles:', error);
+        // Continue without RBAC roles if there's an error
+      }
+
+      // Store IAM user session data with RBAC context
+      authData = {
+        authType: 'iam',
+        userId: user._id,
+        email: user.email,
+        name: user.name,
+        role: user.role, // Keep for backward compatibility
+        rbacRoles: rbacRoles, // New RBAC context
+        authenticated: true,
+        loginTime: new Date().toISOString()
+      };
+
+    } else {
+      // Basic auth authentication - validate against environment variables
+      const isValid = validateBasicAuth(identifier, password);
+      
+      if (!isValid) {
+        return res.redirect(`${req.adminPath || '/admin'}/login?error=Invalid credentials`);
+      }
+
+      // Store basic auth session data
+      authData = {
+        authType: 'basic',
+        username: identifier,
+        role: 'admin', // Basic auth users have admin privileges
+        authenticated: true,
+        loginTime: new Date().toISOString()
+      };
+    }
+
+    // Create session
+    req.session = req.session || {};
+    Object.assign(req.session, authData);
+    
+    // Regenerate session to prevent fixation
+    req.session.regenerate((err) => {
+      if (err) {
+        console.error('Error regenerating session:', err);
+        return res.redirect(`${req.adminPath || '/admin'}/login?error=Session error`);
+      }
+
+      // Store auth data in new session
+      Object.assign(req.session, authData);
+      
+      // Save session and redirect
+      req.session.save((saveErr) => {
+        if (saveErr) {
+          console.error('Error saving session:', saveErr);
+          return res.redirect(`${req.adminPath || '/admin'}/login?error=Session save error`);
+        }
+
+        // Redirect to admin dashboard or originally requested URL
+        const redirectTo = req.session.returnTo || (req.adminPath || '/admin');
+        delete req.session.returnTo;
+        res.redirect(redirectTo);
+      });
+    });
+
+  } catch (error) {
+    console.error('Login error:', error);
+    res.redirect(`${req.adminPath || '/admin'}/login?error=Authentication failed`);
+  }
+});
+
+/**
+ * Logout user and clear session
+ */
+const postLogout = asyncHandler(async (req, res) => {
+  req.session.destroy((err) => {
+    if (err) {
+      console.error('Error destroying session:', err);
+    }
+    
+    res.redirect(`${req.adminPath || '/admin'}/login?success=Logged out successfully`);
+  });
+});
+
+/**
+ * Check current authentication status (API endpoint)
+ */
+const getAuthStatus = asyncHandler(async (req, res) => {
+  if (!req.session || !req.session.authenticated) {
+    return res.json({ 
+      authenticated: false, 
+      authType: null,
+      user: null 
+    });
+  }
+
+  const authData = {
+    authenticated: req.session.authenticated,
+    authType: req.session.authType,
+    loginTime: req.session.loginTime
+  };
+
+  if (req.session.authType === 'iam') {
+    authData.user = {
+      id: req.session.userId,
+      email: req.session.email,
+      name: req.session.name,
+      role: req.session.role
+    };
+  } else {
+    authData.user = {
+      username: req.session.username,
+      role: req.session.role
+    };
+  }
+
+  res.json(authData);
+});
+
+module.exports = {
+  getLogin,
+  postLogin,
+  postLogout,
+  getAuthStatus
+};