libre-webui 0.22.1 → 0.23.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/backend/dist/index.d.ts.map +1 -1
- package/backend/dist/index.js +8 -0
- package/backend/dist/index.js.map +1 -1
- package/backend/dist/middleware/auth.d.ts +15 -1
- package/backend/dist/middleware/auth.d.ts.map +1 -1
- package/backend/dist/middleware/auth.js +153 -33
- package/backend/dist/middleware/auth.js.map +1 -1
- package/backend/dist/persistence/index.d.ts +1 -0
- package/backend/dist/persistence/index.d.ts.map +1 -1
- package/backend/dist/persistence/index.js.map +1 -1
- package/backend/dist/persistence/postgresMigrationRegistry.d.ts.map +1 -1
- package/backend/dist/persistence/postgresMigrationRegistry.js +2 -0
- package/backend/dist/persistence/postgresMigrationRegistry.js.map +1 -1
- package/backend/dist/persistence/postgresPersistence.d.ts.map +1 -1
- package/backend/dist/persistence/postgresPersistence.js +4 -0
- package/backend/dist/persistence/postgresPersistence.js.map +1 -1
- package/backend/dist/persistence/postgresSecurityRepositories.d.ts +7 -0
- package/backend/dist/persistence/postgresSecurityRepositories.d.ts.map +1 -0
- package/backend/dist/persistence/postgresSecurityRepositories.js +435 -0
- package/backend/dist/persistence/postgresSecurityRepositories.js.map +1 -0
- package/backend/dist/persistence/postgresTrustFoundationMigration.d.ts +8 -0
- package/backend/dist/persistence/postgresTrustFoundationMigration.d.ts.map +1 -0
- package/backend/dist/persistence/postgresTrustFoundationMigration.js +151 -0
- package/backend/dist/persistence/postgresTrustFoundationMigration.js.map +1 -0
- package/backend/dist/persistence/securityTypes.d.ts +196 -0
- package/backend/dist/persistence/securityTypes.d.ts.map +1 -0
- package/backend/dist/persistence/securityTypes.js +18 -0
- package/backend/dist/persistence/securityTypes.js.map +1 -0
- package/backend/dist/persistence/sqliteMigrations.d.ts +1 -0
- package/backend/dist/persistence/sqliteMigrations.d.ts.map +1 -1
- package/backend/dist/persistence/sqliteMigrations.js +311 -0
- package/backend/dist/persistence/sqliteMigrations.js.map +1 -1
- package/backend/dist/persistence/sqlitePersistence.d.ts.map +1 -1
- package/backend/dist/persistence/sqlitePersistence.js +3 -0
- package/backend/dist/persistence/sqlitePersistence.js.map +1 -1
- package/backend/dist/persistence/sqliteSecurityRepositories.d.ts +6 -0
- package/backend/dist/persistence/sqliteSecurityRepositories.d.ts.map +1 -0
- package/backend/dist/persistence/sqliteSecurityRepositories.js +497 -0
- package/backend/dist/persistence/sqliteSecurityRepositories.js.map +1 -0
- package/backend/dist/persistence/sqliteToPostgresMigration.d.ts.map +1 -1
- package/backend/dist/persistence/sqliteToPostgresMigration.js +55 -0
- package/backend/dist/persistence/sqliteToPostgresMigration.js.map +1 -1
- package/backend/dist/persistence/types.d.ts +4 -0
- package/backend/dist/persistence/types.d.ts.map +1 -1
- package/backend/dist/platform/jobs/domainJobHandlers.d.ts.map +1 -1
- package/backend/dist/platform/jobs/domainJobHandlers.js +7 -0
- package/backend/dist/platform/jobs/domainJobHandlers.js.map +1 -1
- package/backend/dist/routes/access.d.ts +3 -0
- package/backend/dist/routes/access.d.ts.map +1 -0
- package/backend/dist/routes/access.js +134 -0
- package/backend/dist/routes/access.js.map +1 -0
- package/backend/dist/routes/audit.d.ts +3 -0
- package/backend/dist/routes/audit.d.ts.map +1 -0
- package/backend/dist/routes/audit.js +82 -0
- package/backend/dist/routes/audit.js.map +1 -0
- package/backend/dist/routes/auth.d.ts.map +1 -1
- package/backend/dist/routes/auth.js +342 -14
- package/backend/dist/routes/auth.js.map +1 -1
- package/backend/dist/routes/groups.d.ts +3 -0
- package/backend/dist/routes/groups.d.ts.map +1 -0
- package/backend/dist/routes/groups.js +161 -0
- package/backend/dist/routes/groups.js.map +1 -0
- package/backend/dist/services/apiTokenService.d.ts +51 -0
- package/backend/dist/services/apiTokenService.d.ts.map +1 -0
- package/backend/dist/services/apiTokenService.js +220 -0
- package/backend/dist/services/apiTokenService.js.map +1 -0
- package/backend/dist/services/authService.d.ts +20 -4
- package/backend/dist/services/authService.d.ts.map +1 -1
- package/backend/dist/services/authService.js +44 -6
- package/backend/dist/services/authService.js.map +1 -1
- package/backend/dist/services/authSessionService.d.ts +34 -0
- package/backend/dist/services/authSessionService.d.ts.map +1 -0
- package/backend/dist/services/authSessionService.js +205 -0
- package/backend/dist/services/authSessionService.js.map +1 -0
- package/backend/dist/services/authorizationService.d.ts +64 -0
- package/backend/dist/services/authorizationService.d.ts.map +1 -0
- package/backend/dist/services/authorizationService.js +176 -0
- package/backend/dist/services/authorizationService.js.map +1 -0
- package/backend/dist/services/groupService.d.ts +27 -0
- package/backend/dist/services/groupService.d.ts.map +1 -0
- package/backend/dist/services/groupService.js +245 -0
- package/backend/dist/services/groupService.js.map +1 -0
- package/backend/dist/services/groupVectorPrincipalResolver.d.ts +12 -0
- package/backend/dist/services/groupVectorPrincipalResolver.d.ts.map +1 -0
- package/backend/dist/services/groupVectorPrincipalResolver.js +33 -0
- package/backend/dist/services/groupVectorPrincipalResolver.js.map +1 -0
- package/backend/dist/services/modelAccessService.d.ts +1 -0
- package/backend/dist/services/modelAccessService.d.ts.map +1 -1
- package/backend/dist/services/modelAccessService.js +3 -5
- package/backend/dist/services/modelAccessService.js.map +1 -1
- package/backend/dist/services/oauthSecurity.d.ts +12 -1
- package/backend/dist/services/oauthSecurity.d.ts.map +1 -1
- package/backend/dist/services/oauthSecurity.js +41 -0
- package/backend/dist/services/oauthSecurity.js.map +1 -1
- package/backend/dist/services/resourceGrantService.d.ts +28 -0
- package/backend/dist/services/resourceGrantService.d.ts.map +1 -0
- package/backend/dist/services/resourceGrantService.js +192 -0
- package/backend/dist/services/resourceGrantService.js.map +1 -0
- package/backend/dist/services/securityAuditService.d.ts +35 -0
- package/backend/dist/services/securityAuditService.d.ts.map +1 -0
- package/backend/dist/services/securityAuditService.js +159 -0
- package/backend/dist/services/securityAuditService.js.map +1 -0
- package/backend/dist/services/simpleGitHubOAuth.d.ts.map +1 -1
- package/backend/dist/services/simpleGitHubOAuth.js +4 -2
- package/backend/dist/services/simpleGitHubOAuth.js.map +1 -1
- package/backend/dist/services/simpleOidcOAuth.d.ts +62 -0
- package/backend/dist/services/simpleOidcOAuth.d.ts.map +1 -0
- package/backend/dist/services/simpleOidcOAuth.js +397 -0
- package/backend/dist/services/simpleOidcOAuth.js.map +1 -0
- package/backend/dist/services/webSearchService.d.ts +1 -0
- package/backend/dist/services/webSearchService.d.ts.map +1 -1
- package/backend/dist/services/webSearchService.js +3 -5
- package/backend/dist/services/webSearchService.js.map +1 -1
- package/backend/dist/services/websocketTicketService.d.ts +3 -1
- package/backend/dist/services/websocketTicketService.d.ts.map +1 -1
- package/backend/dist/services/websocketTicketService.js +4 -1
- package/backend/dist/services/websocketTicketService.js.map +1 -1
- package/backend/dist/services/workAccessService.d.ts +1 -0
- package/backend/dist/services/workAccessService.d.ts.map +1 -1
- package/backend/dist/services/workAccessService.js +3 -5
- package/backend/dist/services/workAccessService.js.map +1 -1
- package/backend/dist/services/workEventService.d.ts.map +1 -1
- package/backend/dist/services/workEventService.js +74 -18
- package/backend/dist/services/workEventService.js.map +1 -1
- package/backend/dist/services/workRuntimeService.d.ts +11 -0
- package/backend/dist/services/workRuntimeService.d.ts.map +1 -1
- package/backend/dist/services/workRuntimeService.js +78 -23
- package/backend/dist/services/workRuntimeService.js.map +1 -1
- package/backend/dist/websocketServer.d.ts.map +1 -1
- package/backend/dist/websocketServer.js +25 -1
- package/backend/dist/websocketServer.js.map +1 -1
- package/backend/dist/workTerminalServer.d.ts.map +1 -1
- package/backend/dist/workTerminalServer.js +19 -1
- package/backend/dist/workTerminalServer.js.map +1 -1
- package/backend/dist/worker.js +2 -0
- package/backend/dist/worker.js.map +1 -1
- package/backend/package.json +1 -1
- package/frontend/dist/artifact-runtime/.build-fingerprint +1 -1
- package/frontend/dist/assets/index-BXMQqOXF.js +11 -0
- package/frontend/dist/assets/index-DBaj1DRj.css +1 -0
- package/frontend/dist/index.html +11 -11
- package/frontend/dist/js/ArtifactContainer-BUjOZ5M5.js +1 -0
- package/frontend/dist/js/{ArtifactDemoPage-BDBXYv9l.js → ArtifactDemoPage-QRve-734.js} +1 -1
- package/frontend/dist/js/{ArtifactSandboxFrame-BN16NtKe.js → ArtifactSandboxFrame-DhvA-t-7.js} +2 -2
- package/frontend/dist/js/ArtifactSlideOutPanel-B8w1Orr1.js +1 -0
- package/frontend/dist/js/ChatPage-DKVwaYxn.js +23 -0
- package/frontend/dist/js/FirstTimeSetup-DaQveC0v.js +1 -0
- package/frontend/dist/js/{GalleryPage-CV_vbE7X.js → GalleryPage-Cz-VvarV.js} +1 -1
- package/frontend/dist/js/{HomePage-P-e7Huco.js → HomePage-DF9pZ5V5.js} +1 -1
- package/frontend/dist/js/{LibreClawPage-Cee06SUM.js → LibreClawPage-Dw8YQyFj.js} +1 -1
- package/frontend/dist/js/{ModelManagerModals-D7jIT3v1.js → ModelManagerModals-CZAWUxjI.js} +1 -1
- package/frontend/dist/js/{ModelSelector-DXucbvrz.js → ModelSelector-Cc91MEm4.js} +1 -1
- package/frontend/dist/js/ModelsPage-BgaQuCry.js +2 -0
- package/frontend/dist/js/{NotesPage-rEIPWGIb.js → NotesPage-CRAo-TFI.js} +1 -1
- package/frontend/dist/js/{PersonasPage-BXtepFuD.js → PersonasPage-DpN8DQkY.js} +2 -2
- package/frontend/dist/js/{PluginUsagePage-hhu8cxsu.js → PluginUsagePage-5PXXZXle.js} +1 -1
- package/frontend/dist/js/{RichMessageContent-DkiEvdSg.js → RichMessageContent-C67tFlr1.js} +1 -1
- package/frontend/dist/js/SettingsModal-BEzMSDlp.js +1 -0
- package/frontend/dist/js/SystemPage-FUnoW7Er.js +1 -0
- package/frontend/dist/js/UserManagementPage-SBsRbt0H.js +1 -0
- package/frontend/dist/js/WorkPage-D3ChSFo-.js +6 -0
- package/frontend/dist/js/api-Dw_IuHaz.js +14 -0
- package/frontend/dist/js/{appStore-DRSSjaHn.js → appStore-DAT2R-5p.js} +2 -2
- package/frontend/dist/js/ar-D0z0P4rC.js +2 -0
- package/frontend/dist/js/{authStore-BVykIRec.js → authStore-CwSMGkEM.js} +3 -3
- package/frontend/dist/js/bn-BYYU41A7.js +2 -0
- package/frontend/dist/js/chatStore-BK6YcouV.js +3 -0
- package/frontend/dist/js/{config-BTlPm-cZ.js → config-0eBxRk6E.js} +1 -1
- package/frontend/dist/js/cs-BFx6KNZe.js +2 -0
- package/frontend/dist/js/da-DSDuY5Du.js +2 -0
- package/frontend/dist/js/de-YqhP0FmX.js +2 -0
- package/frontend/dist/js/es-Dpr_y1cN.js +2 -0
- package/frontend/dist/js/{estree-CfYahF_d.js → estree-Db_NKIE7.js} +1 -1
- package/frontend/dist/js/fr-nVg_iAEC.js +2 -0
- package/frontend/dist/js/hi-gHKYCgkP.js +2 -0
- package/frontend/dist/js/{html-BJsDX1UZ.js → html-INl_p8N8.js} +1 -1
- package/frontend/dist/js/id-C_yID1Zk.js +2 -0
- package/frontend/dist/js/is-MoRPLbOM.js +2 -0
- package/frontend/dist/js/it-BZTscLxR.js +2 -0
- package/frontend/dist/js/ja-DpIbtmZq.js +2 -0
- package/frontend/dist/js/ko-LkWggmjU.js +2 -0
- package/frontend/dist/js/{markdown-GLyuUNig.js → markdown-DQbfLH11.js} +1 -1
- package/frontend/dist/js/{messageCodeStyles-BHddEFP1.js → messageCodeStyles-D7zXzjgH.js} +2 -2
- package/frontend/dist/js/ms-p3XiQSAo.js +2 -0
- package/frontend/dist/js/nl-sEHHO2Kb.js +2 -0
- package/frontend/dist/js/pl-D2GD6PDW.js +2 -0
- package/frontend/dist/js/pt-DPkn3GUn.js +2 -0
- package/frontend/dist/js/ru-C42iHrEd.js +2 -0
- package/frontend/dist/js/{standalone-Dh56V0YW.js → standalone-CFSd7xCM.js} +1 -1
- package/frontend/dist/js/sv-CGvHo4os.js +2 -0
- package/frontend/dist/js/th-BaDNpCdY.js +2 -0
- package/frontend/dist/js/tr-BHQvi1cN.js +2 -0
- package/frontend/dist/js/{typescript-DRy7A9w4.js → typescript-BIFKSiW0.js} +1 -1
- package/frontend/dist/js/{ui-CuY4IifA.js → ui-CS8EAgvS.js} +2 -2
- package/frontend/dist/js/{ui-vendor-D3Ahl1x5.js → ui-vendor-54SgntkX.js} +1 -1
- package/frontend/dist/js/uk-7pNGS1b2.js +2 -0
- package/frontend/dist/js/vi-DgAfh6mo.js +2 -0
- package/frontend/dist/js/{workApi-DHuYNHLf.js → workApi-DlmJ72dN.js} +2 -2
- package/frontend/dist/js/zh-FRTz6ZqA.js +2 -0
- package/package.json +2 -2
- package/frontend/dist/assets/index-Jtx9Amhz.js +0 -16
- package/frontend/dist/assets/index-kxtZQLV6.css +0 -1
- package/frontend/dist/js/ArtifactContainer-fZegtmva.js +0 -1
- package/frontend/dist/js/ArtifactSlideOutPanel-x1fS85Ww.js +0 -1
- package/frontend/dist/js/ChatPage-C_pXh7WN.js +0 -23
- package/frontend/dist/js/FirstTimeSetup-oRrlZnBm.js +0 -1
- package/frontend/dist/js/ModelsPage-C3_fZpMM.js +0 -2
- package/frontend/dist/js/SettingsModal-BNxCtJ51.js +0 -1
- package/frontend/dist/js/SystemPage-BvvKFuoG.js +0 -1
- package/frontend/dist/js/UserManagementPage-BccyR7si.js +0 -1
- package/frontend/dist/js/WorkPage-BgxrvY3I.js +0 -6
- package/frontend/dist/js/api-BvPDxsUQ.js +0 -14
- package/frontend/dist/js/ar-xTSvTq05.js +0 -2
- package/frontend/dist/js/bn-iYAsohEA.js +0 -2
- package/frontend/dist/js/chatStore-UPp5TV_t.js +0 -3
- package/frontend/dist/js/cs-YBHN88Hb.js +0 -2
- package/frontend/dist/js/da-D7qlLy_k.js +0 -2
- package/frontend/dist/js/de-DV671k2c.js +0 -2
- package/frontend/dist/js/es-kyBgzNq-.js +0 -2
- package/frontend/dist/js/fr-Cw1vut7I.js +0 -2
- package/frontend/dist/js/hi-DWEFC024.js +0 -2
- package/frontend/dist/js/id-DlMHjjy0.js +0 -2
- package/frontend/dist/js/is-B9E_a7dG.js +0 -2
- package/frontend/dist/js/it-DawmVbLC.js +0 -2
- package/frontend/dist/js/ja-DmVvwY3W.js +0 -2
- package/frontend/dist/js/ko-DzOPpkVs.js +0 -2
- package/frontend/dist/js/ms-DpsaOPht.js +0 -2
- package/frontend/dist/js/nl-B1d8W22n.js +0 -2
- package/frontend/dist/js/pl-nCncRVgt.js +0 -2
- package/frontend/dist/js/pt-DHw8fGuu.js +0 -2
- package/frontend/dist/js/ru-Derl_YP_.js +0 -2
- package/frontend/dist/js/sv-pJAfBVo0.js +0 -2
- package/frontend/dist/js/th-C_7fIGnk.js +0 -2
- package/frontend/dist/js/tr-CPqsJvaP.js +0 -2
- package/frontend/dist/js/uk-3o8P_kFi.js +0 -2
- package/frontend/dist/js/vi-Dv6N7OVD.js +0 -2
- package/frontend/dist/js/zh-qg5iqtPi.js +0 -2
|
@@ -0,0 +1,134 @@
|
|
|
1
|
+
/*
|
|
2
|
+
* Libre WebUI
|
|
3
|
+
* Copyright (C) 2025 Kroonen AI, Inc.
|
|
4
|
+
*
|
|
5
|
+
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
6
|
+
* you may not use this file except in compliance with the License.
|
|
7
|
+
* You may obtain a copy of the License at:
|
|
8
|
+
*
|
|
9
|
+
* http://www.apache.org/licenses/LICENSE-2.0
|
|
10
|
+
*
|
|
11
|
+
* Unless required by applicable law or agreed to in writing, software
|
|
12
|
+
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
13
|
+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
14
|
+
* See the License for the specific language governing permissions and
|
|
15
|
+
* limitations under the License.
|
|
16
|
+
*/
|
|
17
|
+
/**
|
|
18
|
+
* Resource-grant management (IAM-03). Owners (and grant-admins) manage
|
|
19
|
+
* shares on their own resources; a user can always list what is shared
|
|
20
|
+
* with them and leave a share.
|
|
21
|
+
*/
|
|
22
|
+
import express from 'express';
|
|
23
|
+
import rateLimit from '../middleware/sharedRateLimit.js';
|
|
24
|
+
import { authenticate } from '../middleware/auth.js';
|
|
25
|
+
import { createGrant, deleteGrant, listGrantsForActor, listGrantsForResource, ResourceGrantError, } from '../services/resourceGrantService.js';
|
|
26
|
+
import { createLogger } from '../utils/logger.js';
|
|
27
|
+
const router = express.Router();
|
|
28
|
+
const logger = createLogger('access-routes');
|
|
29
|
+
const accessRateLimiter = rateLimit({
|
|
30
|
+
keyPrefix: 'resource-access',
|
|
31
|
+
windowMs: 15 * 60 * 1000,
|
|
32
|
+
max: 240,
|
|
33
|
+
message: { success: false, message: 'Too many requests' },
|
|
34
|
+
standardHeaders: true,
|
|
35
|
+
legacyHeaders: false,
|
|
36
|
+
});
|
|
37
|
+
router.use(accessRateLimiter, authenticate);
|
|
38
|
+
const actorOf = (req) => ({
|
|
39
|
+
userId: req.user.userId,
|
|
40
|
+
role: req.user.role,
|
|
41
|
+
});
|
|
42
|
+
const handleError = (res, error, fallback) => {
|
|
43
|
+
if (error instanceof ResourceGrantError) {
|
|
44
|
+
res
|
|
45
|
+
.status(error.statusCode)
|
|
46
|
+
.json({ success: false, message: error.message });
|
|
47
|
+
return;
|
|
48
|
+
}
|
|
49
|
+
logger.error(fallback, error);
|
|
50
|
+
res.status(500).json({ success: false, message: 'Internal server error' });
|
|
51
|
+
};
|
|
52
|
+
const publicGrant = (grant) => ({
|
|
53
|
+
id: grant.id,
|
|
54
|
+
resourceType: grant.resource_type,
|
|
55
|
+
resourceId: grant.resource_id,
|
|
56
|
+
principalType: grant.principal_type,
|
|
57
|
+
principalId: grant.principal_id,
|
|
58
|
+
permission: grant.permission,
|
|
59
|
+
createdAt: new Date(grant.created_at).toISOString(),
|
|
60
|
+
});
|
|
61
|
+
/** Grants on one of the caller's resources. */
|
|
62
|
+
router.get('/grants', async (req, res) => {
|
|
63
|
+
try {
|
|
64
|
+
const { type, id } = req.query;
|
|
65
|
+
if (typeof type !== 'string' || typeof id !== 'string') {
|
|
66
|
+
res
|
|
67
|
+
.status(400)
|
|
68
|
+
.json({ success: false, message: 'type and id are required' });
|
|
69
|
+
return;
|
|
70
|
+
}
|
|
71
|
+
const grants = await listGrantsForResource(actorOf(req), type, id);
|
|
72
|
+
res.json({ success: true, data: grants.map(publicGrant) });
|
|
73
|
+
}
|
|
74
|
+
catch (error) {
|
|
75
|
+
handleError(res, error, 'Grant list error:');
|
|
76
|
+
}
|
|
77
|
+
});
|
|
78
|
+
/** Share a resource with a user or group. */
|
|
79
|
+
router.post('/grants', async (req, res) => {
|
|
80
|
+
try {
|
|
81
|
+
const { resourceType, resourceId, principalType, principalId, permission } = req.body ?? {};
|
|
82
|
+
for (const [field, value] of Object.entries({
|
|
83
|
+
resourceType,
|
|
84
|
+
resourceId,
|
|
85
|
+
principalType,
|
|
86
|
+
principalId,
|
|
87
|
+
permission,
|
|
88
|
+
})) {
|
|
89
|
+
if (typeof value !== 'string' || !value) {
|
|
90
|
+
res
|
|
91
|
+
.status(400)
|
|
92
|
+
.json({ success: false, message: `${field} is required` });
|
|
93
|
+
return;
|
|
94
|
+
}
|
|
95
|
+
}
|
|
96
|
+
const grant = await createGrant(actorOf(req), {
|
|
97
|
+
resourceType,
|
|
98
|
+
resourceId,
|
|
99
|
+
principalType,
|
|
100
|
+
principalId,
|
|
101
|
+
permission,
|
|
102
|
+
});
|
|
103
|
+
res.status(201).json({ success: true, data: publicGrant(grant) });
|
|
104
|
+
}
|
|
105
|
+
catch (error) {
|
|
106
|
+
handleError(res, error, 'Grant create error:');
|
|
107
|
+
}
|
|
108
|
+
});
|
|
109
|
+
/** Remove a grant (owner, grant-admin, or the granted user leaving). */
|
|
110
|
+
router.delete('/grants/:id', async (req, res) => {
|
|
111
|
+
try {
|
|
112
|
+
const deleted = await deleteGrant(actorOf(req), req.params.id);
|
|
113
|
+
if (!deleted) {
|
|
114
|
+
res.status(404).json({ success: false, message: 'Grant not found' });
|
|
115
|
+
return;
|
|
116
|
+
}
|
|
117
|
+
res.json({ success: true });
|
|
118
|
+
}
|
|
119
|
+
catch (error) {
|
|
120
|
+
handleError(res, error, 'Grant delete error:');
|
|
121
|
+
}
|
|
122
|
+
});
|
|
123
|
+
/** Everything shared with the caller, directly or via groups. */
|
|
124
|
+
router.get('/shared-with-me', async (req, res) => {
|
|
125
|
+
try {
|
|
126
|
+
const grants = await listGrantsForActor(actorOf(req));
|
|
127
|
+
res.json({ success: true, data: grants.map(publicGrant) });
|
|
128
|
+
}
|
|
129
|
+
catch (error) {
|
|
130
|
+
handleError(res, error, 'Shared list error:');
|
|
131
|
+
}
|
|
132
|
+
});
|
|
133
|
+
export default router;
|
|
134
|
+
//# sourceMappingURL=access.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/routes/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;GAIG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,SAAS,MAAM,kCAAkC,CAAC;AACzD,OAAO,EAAE,YAAY,EAAwB,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EACL,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAChC,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAE7C,MAAM,iBAAiB,GAAG,SAAS,CAAC;IAClC,SAAS,EAAE,iBAAiB;IAC5B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,GAAG,EAAE,GAAG;IACR,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE;IACzD,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;CACrB,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;AAE5C,MAAM,OAAO,GAAG,CAAC,GAAyB,EAAc,EAAE,CAAC,CAAC;IAC1D,MAAM,EAAE,GAAG,CAAC,IAAK,CAAC,MAAM;IACxB,IAAI,EAAE,GAAG,CAAC,IAAK,CAAC,IAAI;CACrB,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAClB,GAAqB,EACrB,KAAc,EACd,QAAgB,EACV,EAAE;IACR,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;QACxC,GAAG;aACA,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;aACxB,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAC7E,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,KAQpB,EAAE,EAAE,CAAC,CAAC;IACL,EAAE,EAAE,KAAK,CAAC,EAAE;IACZ,YAAY,EAAE,KAAK,CAAC,aAAa;IACjC,UAAU,EAAE,KAAK,CAAC,WAAW;IAC7B,aAAa,EAAE,KAAK,CAAC,cAAc;IACnC,WAAW,EAAE,KAAK,CAAC,YAAY;IAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;IAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;CACpD,CAAC,CAAC;AAEH,+CAA+C;AAC/C,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IAC7D,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;QAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YACvD,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,6CAA6C;AAC7C,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IAC9D,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,GACxE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;YAC1C,YAAY;YACZ,UAAU;YACV,aAAa;YACb,WAAW;YACX,UAAU;SACX,CAAC,EAAE,CAAC;YACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;gBACxC,GAAG;qBACA,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,cAAc,EAAE,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;YAC5C,YAAY;YACZ,UAAU;YACV,aAAa;YACb,WAAW;YACX,UAAU;SACX,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACjD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,wEAAwE;AACxE,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACpE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACjD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACrE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/routes/audit.ts"],"names":[],"mappings":"AAuBA,QAAA,MAAM,MAAM,4CAAmB,CAAC;eAkEjB,MAAM"}
|
|
@@ -0,0 +1,82 @@
|
|
|
1
|
+
/*
|
|
2
|
+
* Libre WebUI
|
|
3
|
+
* Copyright (C) 2025 Kroonen AI, Inc.
|
|
4
|
+
*
|
|
5
|
+
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
6
|
+
* you may not use this file except in compliance with the License.
|
|
7
|
+
* You may obtain a copy of the License at:
|
|
8
|
+
*
|
|
9
|
+
* http://www.apache.org/licenses/LICENSE-2.0
|
|
10
|
+
*
|
|
11
|
+
* Unless required by applicable law or agreed to in writing, software
|
|
12
|
+
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
13
|
+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
14
|
+
* See the License for the specific language governing permissions and
|
|
15
|
+
* limitations under the License.
|
|
16
|
+
*/
|
|
17
|
+
import express from 'express';
|
|
18
|
+
import rateLimit from '../middleware/sharedRateLimit.js';
|
|
19
|
+
import { authenticate, requireAdmin } from '../middleware/auth.js';
|
|
20
|
+
import { queryAuditEvents } from '../services/securityAuditService.js';
|
|
21
|
+
import { createLogger } from '../utils/logger.js';
|
|
22
|
+
const router = express.Router();
|
|
23
|
+
const logger = createLogger('audit-routes');
|
|
24
|
+
const auditRateLimiter = rateLimit({
|
|
25
|
+
keyPrefix: 'security-audit',
|
|
26
|
+
windowMs: 15 * 60 * 1000,
|
|
27
|
+
max: 120,
|
|
28
|
+
message: { success: false, message: 'Too many requests' },
|
|
29
|
+
standardHeaders: true,
|
|
30
|
+
legacyHeaders: false,
|
|
31
|
+
});
|
|
32
|
+
router.use(auditRateLimiter, authenticate, requireAdmin);
|
|
33
|
+
/** Query the security audit log (admin only, redacted at write time). */
|
|
34
|
+
router.get('/', async (req, res) => {
|
|
35
|
+
try {
|
|
36
|
+
const { action, actor, result, targetType, before, after, limit } = req.query;
|
|
37
|
+
const parseEpoch = (value) => {
|
|
38
|
+
if (typeof value !== 'string' || !value)
|
|
39
|
+
return undefined;
|
|
40
|
+
const asNumber = Number(value);
|
|
41
|
+
if (Number.isFinite(asNumber) && asNumber > 0)
|
|
42
|
+
return asNumber;
|
|
43
|
+
const asDate = Date.parse(value);
|
|
44
|
+
return Number.isFinite(asDate) ? asDate : undefined;
|
|
45
|
+
};
|
|
46
|
+
const isResult = (value) => value === 'success' || value === 'denied' || value === 'failure';
|
|
47
|
+
const events = await queryAuditEvents({
|
|
48
|
+
...(typeof action === 'string' && action ? { action } : {}),
|
|
49
|
+
...(typeof actor === 'string' && actor ? { actorUserId: actor } : {}),
|
|
50
|
+
...(isResult(result) ? { result } : {}),
|
|
51
|
+
...(typeof targetType === 'string' && targetType ? { targetType } : {}),
|
|
52
|
+
...(parseEpoch(before) !== undefined
|
|
53
|
+
? { before: parseEpoch(before) }
|
|
54
|
+
: {}),
|
|
55
|
+
...(parseEpoch(after) !== undefined ? { after: parseEpoch(after) } : {}),
|
|
56
|
+
...(typeof limit === 'string' && Number.isFinite(Number(limit))
|
|
57
|
+
? { limit: Number(limit) }
|
|
58
|
+
: {}),
|
|
59
|
+
});
|
|
60
|
+
res.json({
|
|
61
|
+
success: true,
|
|
62
|
+
data: events.map(event => ({
|
|
63
|
+
id: event.id,
|
|
64
|
+
occurredAt: new Date(event.occurred_at).toISOString(),
|
|
65
|
+
actorUserId: event.actor_user_id,
|
|
66
|
+
actorKind: event.actor_kind,
|
|
67
|
+
action: event.action,
|
|
68
|
+
targetType: event.target_type,
|
|
69
|
+
targetId: event.target_id,
|
|
70
|
+
result: event.result,
|
|
71
|
+
requestId: event.request_id,
|
|
72
|
+
details: event.details ? JSON.parse(event.details) : null,
|
|
73
|
+
})),
|
|
74
|
+
});
|
|
75
|
+
}
|
|
76
|
+
catch (error) {
|
|
77
|
+
logger.error('Audit query error:', error);
|
|
78
|
+
res.status(500).json({ success: false, message: 'Internal server error' });
|
|
79
|
+
}
|
|
80
|
+
});
|
|
81
|
+
export default router;
|
|
82
|
+
//# sourceMappingURL=audit.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/routes/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,SAAS,MAAM,kCAAkC,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAChC,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;AAE5C,MAAM,gBAAgB,GAAG,SAAS,CAAC;IACjC,SAAS,EAAE,gBAAgB;IAC3B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,GAAG,EAAE,GAAG;IACR,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE;IACzD,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;CACrB,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAEzD,yEAAyE;AACzE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAC/D,GAAG,CAAC,KAAK,CAAC;QACZ,MAAM,UAAU,GAAG,CAAC,KAAc,EAAsB,EAAE;YACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACtD,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,CACf,KAAc,EAC6B,EAAE,CAC7C,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,CAAC;QAEnE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;YACpC,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,SAAS;gBAClC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAE,EAAE;gBACjC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7D,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;gBAC1B,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACzB,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,UAAU,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;gBACrD,WAAW,EAAE,KAAK,CAAC,aAAa;gBAChC,SAAS,EAAE,KAAK,CAAC,UAAU;gBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,WAAW;gBAC7B,QAAQ,EAAE,KAAK,CAAC,SAAS;gBACzB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,UAAU;gBAC3B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;aAC1D,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;QAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AAgEA,QAAA,MAAM,MAAM,4CAAmB,CAAC;eAwgCjB,MAAM"}
|