@lokalise/fastify-bullboard-plugin 3.0.1 → 3.2.0

package/README.md

@@ -44,6 +44,27 @@ await app.register(bullBoard, {
 })
 ```
 
+Each `enableList` entry protects that path and every route under it, so `'/bull'` covers the dashboard page,
+its API (`/bull/api/queues/...`, including the job retry/clean/obliterate endpoints) and its static assets. It does
+not cover routes that only share the string prefix, such as `/bullet`. A trailing slash makes no difference
+(`'/bull/'` behaves like `'/bull'`), empty entries are ignored, and the root path `'/'` is matched exactly.
+
+Entries are full route paths. If BullBoard is registered inside a plugin with its own prefix, list the full path,
+e.g. `'/admin/bull'` for a `/bull` mount under `/admin`.
+
+To protect everything by default instead, pass a `skipList` in place of `enableList`. Every route then requires
+credentials, including the root redirect and unmatched URLs, except the listed route paths:
+
+```ts
+await app.register(basicAuth, {
+  config: { isEnabled: true, username: 'username', password: 'pass' },
+  skipList: new Set(['/health', '/metrics']),
+})
+```
+
+`skipList` entries are matched exactly against the registered route path, so `'/health'` does not skip
+`/health/deep`. Pass either `enableList` or `skipList`, not both.
+
 ## BullMQ Pro support
 
 The plugin supports both standard BullMQ queues and BullMQ Pro queues, including mixing

package/dist/basicAuth.d.ts

@@ -5,7 +5,23 @@ export type AuthConfig = {
 };
 type BasicAuthOptions = {
     config: AuthConfig;
+} & ({
+    /**
+     * Paths that require basic auth. Each entry protects the path itself and every route under it,
+     * e.g. `/bull` (or `/bull/`) covers `/bull`, `/bull/api/queues` and `/bull/static/*`, but not `/bullet`.
+     * Entries are full route paths, so include any prefix the protected routes are registered under.
+     * The root path `/` is matched exactly, so it does not protect the whole app. Empty entries are ignored.
+     */
     enableList: Set<string>;
-};
+    skipList?: never;
+} | {
+    /**
+     * Route paths that do not require basic auth; every other route does, including unmatched ones.
+     * Entries are matched exactly against the registered route path, e.g. `/health` skips `/health` only,
+     * and `/users/:id` skips that parametric route.
+     */
+    skipList: Set<string>;
+    enableList?: never;
+});
 export declare const basicAuth: import("fastify").FastifyPluginCallback<BasicAuthOptions, import("fastify").RawServerDefault, import("fastify").FastifyTypeProviderDefault, import("fastify").FastifyBaseLogger>;
 export {};

package/dist/basicAuth.js

@@ -12,21 +12,66 @@ function validate(config) {
         }
     };
 }
+function toProtectedPaths(enableList) {
+    const exact = new Set();
+    const prefixes = [];
+    for (const entry of enableList) {
+        if (entry === '')
+            continue;
+        const path = entry.replace(/\/+$/, '');
+        // The root is matched exactly: as a prefix it would put auth on every route, health checks included
+        if (path === '') {
+            exact.add('/');
+            continue;
+        }
+        exact.add(path);
+        prefixes.push(`${path}/`);
+    }
+    return { exact, prefixes };
+}
+function requiresAuth(url, protectedPaths) {
+    if (!url)
+        return false;
+    if (protectedPaths.exact.has(url))
+        return true;
+    return protectedPaths.prefixes.some((prefix) => url.startsWith(prefix));
+}
 function enableListAuthHandler(enableList) {
+    const protectedPaths = toProtectedPaths(enableList);
+    return (req, _res, done) => {
+        if (!requiresAuth(req.routeOptions.url, protectedPaths)) {
+            return done(); // success: skip the rest of the handlers
+        }
+        // Matching by prefix, not exact route, is what keeps BullBoard's API routes under /bull/ protected.
+        // Fail here to go to the next handler (basicAuth). String for performance, it also works
+        return done('Needs auth');
+    };
+}
+function skipListAuthHandler(skipList) {
     return (req, _res, done) => {
-        // If the route is NOT in enableList, allow through: skip auth
-        if (!req.routeOptions.url || !enableList.has(req.routeOptions.url)) {
+        if (req.routeOptions.url && skipList.has(req.routeOptions.url)) {
             return done(); // success: skip the rest of the handlers
         }
-        // If the route IS in enableList, fail: go to next handler (basicAuth)
-        // String for performance, it also works
+        // Fail here to go to the next handler (basicAuth). String for performance, it also works
         return done('Needs auth');
     };
 }
+function resolveAccessHandler(pluginOptions) {
+    const { enableList, skipList } = pluginOptions;
+    if (enableList && skipList) {
+        throw new Error('basic-auth: enableList and skipList are mutually exclusive, pass only one');
+    }
+    if (skipList)
+        return skipListAuthHandler(skipList);
+    if (enableList)
+        return enableListAuthHandler(enableList);
+    throw new Error('basic-auth: either enableList or skipList is required');
+}
 async function plugin(fastify, pluginOptions) {
     if (!pluginOptions.config.isEnabled) {
         return;
     }
+    const accessHandler = resolveAccessHandler(pluginOptions);
     if (!fastify.auth) {
         await fastify.register(fastifyAuth);
     }
@@ -35,7 +80,7 @@ async function plugin(fastify, pluginOptions) {
         authenticate: true,
     });
     fastify.after(() => {
-        fastify.addHook('onRequest', fastify.auth([enableListAuthHandler(pluginOptions.enableList), fastify.basicAuth]));
+        fastify.addHook('onRequest', fastify.auth([accessHandler, fastify.basicAuth]));
     });
 }
 export const basicAuth = fp(plugin, {

package/dist/basicAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"basicAuth.js","sourceRoot":"","sources":["../src/basicAuth.ts"],"names":[],"mappings":"AACA,OAAO,WAAW,MAAM,eAAe,CAAA;AACvC,OAAO,gBAAgB,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAErD,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAa/B,SAAS,QAAQ,CAAC,MAAkB;IAClC,OAAO,CACL,QAAgB,EAChB,QAAgB,EAChB,IAAoB,EACpB,MAAoB,EACpB,IAA2B,EAC3B,EAAE;QACF,IAAI,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACjE,IAAI,EAAE,CAAA;QACR,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,eAAe,EAAE,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAuB;IACpD,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACzB,8DAA8D;QAC9D,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,EAAE,CAAA,CAAC,yCAAyC;QACzD,CAAC;QACD,sEAAsE;QACtE,wCAAwC;QACxC,OAAO,IAAI,CAAC,YAAgC,CAAC,CAAA;IAC/C,CAAC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,OAAwB,EAAE,aAA+B;IAC7E,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACpC,OAAM;IACR,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACrC,CAAC;IACD,MAAM,OAAO,CAAC,QAAQ,CAAC,gBAAgB,EAAE;QACvC,QAAQ,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC;QACxC,YAAY,EAAE,IAAI;KACnB,CAAC,CAAA;IAEF,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;QACjB,OAAO,CAAC,OAAO,CACb,WAAW,EACX,OAAO,CAAC,IAAI,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CACnF,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAmB,MAAM,EAAE;IACpD,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,YAAY;CACnB,CAAC,CAAA"}
+{"version":3,"file":"basicAuth.js","sourceRoot":"","sources":["../src/basicAuth.ts"],"names":[],"mappings":"AACA,OAAO,WAAW,MAAM,eAAe,CAAA;AACvC,OAAO,gBAAgB,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAErD,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAgC/B,SAAS,QAAQ,CAAC,MAAkB;IAClC,OAAO,CACL,QAAgB,EAChB,QAAgB,EAChB,IAAoB,EACpB,MAAoB,EACpB,IAA2B,EAC3B,EAAE;QACF,IAAI,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACjE,IAAI,EAAE,CAAA;QACR,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,eAAe,EAAE,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAOD,SAAS,gBAAgB,CAAC,UAAuB;IAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,KAAK,KAAK,EAAE;YAAE,SAAQ;QAE1B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACtC,oGAAoG;QACpG,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACd,SAAQ;QACV,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACf,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAA;IAC3B,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;AAC5B,CAAC;AAED,SAAS,YAAY,CAAC,GAAuB,EAAE,cAA8B;IAC3E,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IACtB,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9C,OAAO,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;AACzE,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAuB;IACpD,MAAM,cAAc,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAA;IAEnD,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;YACxD,OAAO,IAAI,EAAE,CAAA,CAAC,yCAAyC;QACzD,CAAC;QACD,oGAAoG;QACpG,yFAAyF;QACzF,OAAO,IAAI,CAAC,YAAgC,CAAC,CAAA;IAC/C,CAAC,CAAA;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAqB;IAChD,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,EAAE,CAAA,CAAC,yCAAyC;QACzD,CAAC;QACD,yFAAyF;QACzF,OAAO,IAAI,CAAC,YAAgC,CAAC,CAAA;IAC/C,CAAC,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,aAA+B;IAC3D,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAA;IAC9C,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAA;IAC9F,CAAC;IACD,IAAI,QAAQ;QAAE,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAA;IAClD,IAAI,UAAU;QAAE,OAAO,qBAAqB,CAAC,UAAU,CAAC,CAAA;IACxD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;AAC1E,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,OAAwB,EAAE,aAA+B;IAC7E,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACpC,OAAM;IACR,CAAC;IAED,MAAM,aAAa,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAA;IAEzD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACrC,CAAC;IACD,MAAM,OAAO,CAAC,QAAQ,CAAC,gBAAgB,EAAE;QACvC,QAAQ,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC;QACxC,YAAY,EAAE,IAAI;KACnB,CAAC,CAAA;IAEF,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;QACjB,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAChF,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAmB,MAAM,EAAE;IACpD,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,YAAY;CACnB,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lokalise/fastify-bullboard-plugin",
-  "version": "3.0.1",
+  "version": "3.2.0",
   "type": "module",
   "files": [
     "dist",