libre-webui 0.22.1 → 0.23.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (237) hide show
  1. package/backend/dist/index.d.ts.map +1 -1
  2. package/backend/dist/index.js +8 -0
  3. package/backend/dist/index.js.map +1 -1
  4. package/backend/dist/middleware/auth.d.ts +15 -1
  5. package/backend/dist/middleware/auth.d.ts.map +1 -1
  6. package/backend/dist/middleware/auth.js +153 -33
  7. package/backend/dist/middleware/auth.js.map +1 -1
  8. package/backend/dist/persistence/index.d.ts +1 -0
  9. package/backend/dist/persistence/index.d.ts.map +1 -1
  10. package/backend/dist/persistence/index.js.map +1 -1
  11. package/backend/dist/persistence/postgresMigrationRegistry.d.ts.map +1 -1
  12. package/backend/dist/persistence/postgresMigrationRegistry.js +2 -0
  13. package/backend/dist/persistence/postgresMigrationRegistry.js.map +1 -1
  14. package/backend/dist/persistence/postgresPersistence.d.ts.map +1 -1
  15. package/backend/dist/persistence/postgresPersistence.js +4 -0
  16. package/backend/dist/persistence/postgresPersistence.js.map +1 -1
  17. package/backend/dist/persistence/postgresSecurityRepositories.d.ts +7 -0
  18. package/backend/dist/persistence/postgresSecurityRepositories.d.ts.map +1 -0
  19. package/backend/dist/persistence/postgresSecurityRepositories.js +435 -0
  20. package/backend/dist/persistence/postgresSecurityRepositories.js.map +1 -0
  21. package/backend/dist/persistence/postgresTrustFoundationMigration.d.ts +8 -0
  22. package/backend/dist/persistence/postgresTrustFoundationMigration.d.ts.map +1 -0
  23. package/backend/dist/persistence/postgresTrustFoundationMigration.js +151 -0
  24. package/backend/dist/persistence/postgresTrustFoundationMigration.js.map +1 -0
  25. package/backend/dist/persistence/securityTypes.d.ts +196 -0
  26. package/backend/dist/persistence/securityTypes.d.ts.map +1 -0
  27. package/backend/dist/persistence/securityTypes.js +18 -0
  28. package/backend/dist/persistence/securityTypes.js.map +1 -0
  29. package/backend/dist/persistence/sqliteMigrations.d.ts +1 -0
  30. package/backend/dist/persistence/sqliteMigrations.d.ts.map +1 -1
  31. package/backend/dist/persistence/sqliteMigrations.js +311 -0
  32. package/backend/dist/persistence/sqliteMigrations.js.map +1 -1
  33. package/backend/dist/persistence/sqlitePersistence.d.ts.map +1 -1
  34. package/backend/dist/persistence/sqlitePersistence.js +3 -0
  35. package/backend/dist/persistence/sqlitePersistence.js.map +1 -1
  36. package/backend/dist/persistence/sqliteSecurityRepositories.d.ts +6 -0
  37. package/backend/dist/persistence/sqliteSecurityRepositories.d.ts.map +1 -0
  38. package/backend/dist/persistence/sqliteSecurityRepositories.js +497 -0
  39. package/backend/dist/persistence/sqliteSecurityRepositories.js.map +1 -0
  40. package/backend/dist/persistence/sqliteToPostgresMigration.d.ts.map +1 -1
  41. package/backend/dist/persistence/sqliteToPostgresMigration.js +55 -0
  42. package/backend/dist/persistence/sqliteToPostgresMigration.js.map +1 -1
  43. package/backend/dist/persistence/types.d.ts +4 -0
  44. package/backend/dist/persistence/types.d.ts.map +1 -1
  45. package/backend/dist/platform/jobs/domainJobHandlers.d.ts.map +1 -1
  46. package/backend/dist/platform/jobs/domainJobHandlers.js +7 -0
  47. package/backend/dist/platform/jobs/domainJobHandlers.js.map +1 -1
  48. package/backend/dist/routes/access.d.ts +3 -0
  49. package/backend/dist/routes/access.d.ts.map +1 -0
  50. package/backend/dist/routes/access.js +134 -0
  51. package/backend/dist/routes/access.js.map +1 -0
  52. package/backend/dist/routes/audit.d.ts +3 -0
  53. package/backend/dist/routes/audit.d.ts.map +1 -0
  54. package/backend/dist/routes/audit.js +82 -0
  55. package/backend/dist/routes/audit.js.map +1 -0
  56. package/backend/dist/routes/auth.d.ts.map +1 -1
  57. package/backend/dist/routes/auth.js +342 -14
  58. package/backend/dist/routes/auth.js.map +1 -1
  59. package/backend/dist/routes/groups.d.ts +3 -0
  60. package/backend/dist/routes/groups.d.ts.map +1 -0
  61. package/backend/dist/routes/groups.js +161 -0
  62. package/backend/dist/routes/groups.js.map +1 -0
  63. package/backend/dist/services/apiTokenService.d.ts +51 -0
  64. package/backend/dist/services/apiTokenService.d.ts.map +1 -0
  65. package/backend/dist/services/apiTokenService.js +220 -0
  66. package/backend/dist/services/apiTokenService.js.map +1 -0
  67. package/backend/dist/services/authService.d.ts +20 -4
  68. package/backend/dist/services/authService.d.ts.map +1 -1
  69. package/backend/dist/services/authService.js +44 -6
  70. package/backend/dist/services/authService.js.map +1 -1
  71. package/backend/dist/services/authSessionService.d.ts +34 -0
  72. package/backend/dist/services/authSessionService.d.ts.map +1 -0
  73. package/backend/dist/services/authSessionService.js +205 -0
  74. package/backend/dist/services/authSessionService.js.map +1 -0
  75. package/backend/dist/services/authorizationService.d.ts +64 -0
  76. package/backend/dist/services/authorizationService.d.ts.map +1 -0
  77. package/backend/dist/services/authorizationService.js +176 -0
  78. package/backend/dist/services/authorizationService.js.map +1 -0
  79. package/backend/dist/services/groupService.d.ts +27 -0
  80. package/backend/dist/services/groupService.d.ts.map +1 -0
  81. package/backend/dist/services/groupService.js +245 -0
  82. package/backend/dist/services/groupService.js.map +1 -0
  83. package/backend/dist/services/groupVectorPrincipalResolver.d.ts +12 -0
  84. package/backend/dist/services/groupVectorPrincipalResolver.d.ts.map +1 -0
  85. package/backend/dist/services/groupVectorPrincipalResolver.js +33 -0
  86. package/backend/dist/services/groupVectorPrincipalResolver.js.map +1 -0
  87. package/backend/dist/services/modelAccessService.d.ts +1 -0
  88. package/backend/dist/services/modelAccessService.d.ts.map +1 -1
  89. package/backend/dist/services/modelAccessService.js +3 -5
  90. package/backend/dist/services/modelAccessService.js.map +1 -1
  91. package/backend/dist/services/oauthSecurity.d.ts +12 -1
  92. package/backend/dist/services/oauthSecurity.d.ts.map +1 -1
  93. package/backend/dist/services/oauthSecurity.js +41 -0
  94. package/backend/dist/services/oauthSecurity.js.map +1 -1
  95. package/backend/dist/services/resourceGrantService.d.ts +28 -0
  96. package/backend/dist/services/resourceGrantService.d.ts.map +1 -0
  97. package/backend/dist/services/resourceGrantService.js +192 -0
  98. package/backend/dist/services/resourceGrantService.js.map +1 -0
  99. package/backend/dist/services/securityAuditService.d.ts +35 -0
  100. package/backend/dist/services/securityAuditService.d.ts.map +1 -0
  101. package/backend/dist/services/securityAuditService.js +159 -0
  102. package/backend/dist/services/securityAuditService.js.map +1 -0
  103. package/backend/dist/services/simpleGitHubOAuth.d.ts.map +1 -1
  104. package/backend/dist/services/simpleGitHubOAuth.js +4 -2
  105. package/backend/dist/services/simpleGitHubOAuth.js.map +1 -1
  106. package/backend/dist/services/simpleOidcOAuth.d.ts +62 -0
  107. package/backend/dist/services/simpleOidcOAuth.d.ts.map +1 -0
  108. package/backend/dist/services/simpleOidcOAuth.js +397 -0
  109. package/backend/dist/services/simpleOidcOAuth.js.map +1 -0
  110. package/backend/dist/services/webSearchService.d.ts +1 -0
  111. package/backend/dist/services/webSearchService.d.ts.map +1 -1
  112. package/backend/dist/services/webSearchService.js +3 -5
  113. package/backend/dist/services/webSearchService.js.map +1 -1
  114. package/backend/dist/services/websocketTicketService.d.ts +3 -1
  115. package/backend/dist/services/websocketTicketService.d.ts.map +1 -1
  116. package/backend/dist/services/websocketTicketService.js +4 -1
  117. package/backend/dist/services/websocketTicketService.js.map +1 -1
  118. package/backend/dist/services/workAccessService.d.ts +1 -0
  119. package/backend/dist/services/workAccessService.d.ts.map +1 -1
  120. package/backend/dist/services/workAccessService.js +3 -5
  121. package/backend/dist/services/workAccessService.js.map +1 -1
  122. package/backend/dist/services/workEventService.d.ts.map +1 -1
  123. package/backend/dist/services/workEventService.js +74 -18
  124. package/backend/dist/services/workEventService.js.map +1 -1
  125. package/backend/dist/services/workRuntimeService.d.ts +11 -0
  126. package/backend/dist/services/workRuntimeService.d.ts.map +1 -1
  127. package/backend/dist/services/workRuntimeService.js +78 -23
  128. package/backend/dist/services/workRuntimeService.js.map +1 -1
  129. package/backend/dist/websocketServer.d.ts.map +1 -1
  130. package/backend/dist/websocketServer.js +25 -1
  131. package/backend/dist/websocketServer.js.map +1 -1
  132. package/backend/dist/workTerminalServer.d.ts.map +1 -1
  133. package/backend/dist/workTerminalServer.js +19 -1
  134. package/backend/dist/workTerminalServer.js.map +1 -1
  135. package/backend/dist/worker.js +2 -0
  136. package/backend/dist/worker.js.map +1 -1
  137. package/backend/package.json +1 -1
  138. package/frontend/dist/artifact-runtime/.build-fingerprint +1 -1
  139. package/frontend/dist/assets/index-BXMQqOXF.js +11 -0
  140. package/frontend/dist/assets/index-DBaj1DRj.css +1 -0
  141. package/frontend/dist/index.html +11 -11
  142. package/frontend/dist/js/ArtifactContainer-BUjOZ5M5.js +1 -0
  143. package/frontend/dist/js/{ArtifactDemoPage-BDBXYv9l.js → ArtifactDemoPage-QRve-734.js} +1 -1
  144. package/frontend/dist/js/{ArtifactSandboxFrame-BN16NtKe.js → ArtifactSandboxFrame-DhvA-t-7.js} +2 -2
  145. package/frontend/dist/js/ArtifactSlideOutPanel-B8w1Orr1.js +1 -0
  146. package/frontend/dist/js/ChatPage-DKVwaYxn.js +23 -0
  147. package/frontend/dist/js/FirstTimeSetup-DaQveC0v.js +1 -0
  148. package/frontend/dist/js/{GalleryPage-CV_vbE7X.js → GalleryPage-Cz-VvarV.js} +1 -1
  149. package/frontend/dist/js/{HomePage-P-e7Huco.js → HomePage-DF9pZ5V5.js} +1 -1
  150. package/frontend/dist/js/{LibreClawPage-Cee06SUM.js → LibreClawPage-Dw8YQyFj.js} +1 -1
  151. package/frontend/dist/js/{ModelManagerModals-D7jIT3v1.js → ModelManagerModals-CZAWUxjI.js} +1 -1
  152. package/frontend/dist/js/{ModelSelector-DXucbvrz.js → ModelSelector-Cc91MEm4.js} +1 -1
  153. package/frontend/dist/js/ModelsPage-BgaQuCry.js +2 -0
  154. package/frontend/dist/js/{NotesPage-rEIPWGIb.js → NotesPage-CRAo-TFI.js} +1 -1
  155. package/frontend/dist/js/{PersonasPage-BXtepFuD.js → PersonasPage-DpN8DQkY.js} +2 -2
  156. package/frontend/dist/js/{PluginUsagePage-hhu8cxsu.js → PluginUsagePage-5PXXZXle.js} +1 -1
  157. package/frontend/dist/js/{RichMessageContent-DkiEvdSg.js → RichMessageContent-C67tFlr1.js} +1 -1
  158. package/frontend/dist/js/SettingsModal-BEzMSDlp.js +1 -0
  159. package/frontend/dist/js/SystemPage-FUnoW7Er.js +1 -0
  160. package/frontend/dist/js/UserManagementPage-SBsRbt0H.js +1 -0
  161. package/frontend/dist/js/WorkPage-D3ChSFo-.js +6 -0
  162. package/frontend/dist/js/api-Dw_IuHaz.js +14 -0
  163. package/frontend/dist/js/{appStore-DRSSjaHn.js → appStore-DAT2R-5p.js} +2 -2
  164. package/frontend/dist/js/ar-D0z0P4rC.js +2 -0
  165. package/frontend/dist/js/{authStore-BVykIRec.js → authStore-CwSMGkEM.js} +3 -3
  166. package/frontend/dist/js/bn-BYYU41A7.js +2 -0
  167. package/frontend/dist/js/chatStore-BK6YcouV.js +3 -0
  168. package/frontend/dist/js/{config-BTlPm-cZ.js → config-0eBxRk6E.js} +1 -1
  169. package/frontend/dist/js/cs-BFx6KNZe.js +2 -0
  170. package/frontend/dist/js/da-DSDuY5Du.js +2 -0
  171. package/frontend/dist/js/de-YqhP0FmX.js +2 -0
  172. package/frontend/dist/js/es-Dpr_y1cN.js +2 -0
  173. package/frontend/dist/js/{estree-CfYahF_d.js → estree-Db_NKIE7.js} +1 -1
  174. package/frontend/dist/js/fr-nVg_iAEC.js +2 -0
  175. package/frontend/dist/js/hi-gHKYCgkP.js +2 -0
  176. package/frontend/dist/js/{html-BJsDX1UZ.js → html-INl_p8N8.js} +1 -1
  177. package/frontend/dist/js/id-C_yID1Zk.js +2 -0
  178. package/frontend/dist/js/is-MoRPLbOM.js +2 -0
  179. package/frontend/dist/js/it-BZTscLxR.js +2 -0
  180. package/frontend/dist/js/ja-DpIbtmZq.js +2 -0
  181. package/frontend/dist/js/ko-LkWggmjU.js +2 -0
  182. package/frontend/dist/js/{markdown-GLyuUNig.js → markdown-DQbfLH11.js} +1 -1
  183. package/frontend/dist/js/{messageCodeStyles-BHddEFP1.js → messageCodeStyles-D7zXzjgH.js} +2 -2
  184. package/frontend/dist/js/ms-p3XiQSAo.js +2 -0
  185. package/frontend/dist/js/nl-sEHHO2Kb.js +2 -0
  186. package/frontend/dist/js/pl-D2GD6PDW.js +2 -0
  187. package/frontend/dist/js/pt-DPkn3GUn.js +2 -0
  188. package/frontend/dist/js/ru-C42iHrEd.js +2 -0
  189. package/frontend/dist/js/{standalone-Dh56V0YW.js → standalone-CFSd7xCM.js} +1 -1
  190. package/frontend/dist/js/sv-CGvHo4os.js +2 -0
  191. package/frontend/dist/js/th-BaDNpCdY.js +2 -0
  192. package/frontend/dist/js/tr-BHQvi1cN.js +2 -0
  193. package/frontend/dist/js/{typescript-DRy7A9w4.js → typescript-BIFKSiW0.js} +1 -1
  194. package/frontend/dist/js/{ui-CuY4IifA.js → ui-CS8EAgvS.js} +2 -2
  195. package/frontend/dist/js/{ui-vendor-D3Ahl1x5.js → ui-vendor-54SgntkX.js} +1 -1
  196. package/frontend/dist/js/uk-7pNGS1b2.js +2 -0
  197. package/frontend/dist/js/vi-DgAfh6mo.js +2 -0
  198. package/frontend/dist/js/{workApi-DHuYNHLf.js → workApi-DlmJ72dN.js} +2 -2
  199. package/frontend/dist/js/zh-FRTz6ZqA.js +2 -0
  200. package/package.json +2 -2
  201. package/frontend/dist/assets/index-Jtx9Amhz.js +0 -16
  202. package/frontend/dist/assets/index-kxtZQLV6.css +0 -1
  203. package/frontend/dist/js/ArtifactContainer-fZegtmva.js +0 -1
  204. package/frontend/dist/js/ArtifactSlideOutPanel-x1fS85Ww.js +0 -1
  205. package/frontend/dist/js/ChatPage-C_pXh7WN.js +0 -23
  206. package/frontend/dist/js/FirstTimeSetup-oRrlZnBm.js +0 -1
  207. package/frontend/dist/js/ModelsPage-C3_fZpMM.js +0 -2
  208. package/frontend/dist/js/SettingsModal-BNxCtJ51.js +0 -1
  209. package/frontend/dist/js/SystemPage-BvvKFuoG.js +0 -1
  210. package/frontend/dist/js/UserManagementPage-BccyR7si.js +0 -1
  211. package/frontend/dist/js/WorkPage-BgxrvY3I.js +0 -6
  212. package/frontend/dist/js/api-BvPDxsUQ.js +0 -14
  213. package/frontend/dist/js/ar-xTSvTq05.js +0 -2
  214. package/frontend/dist/js/bn-iYAsohEA.js +0 -2
  215. package/frontend/dist/js/chatStore-UPp5TV_t.js +0 -3
  216. package/frontend/dist/js/cs-YBHN88Hb.js +0 -2
  217. package/frontend/dist/js/da-D7qlLy_k.js +0 -2
  218. package/frontend/dist/js/de-DV671k2c.js +0 -2
  219. package/frontend/dist/js/es-kyBgzNq-.js +0 -2
  220. package/frontend/dist/js/fr-Cw1vut7I.js +0 -2
  221. package/frontend/dist/js/hi-DWEFC024.js +0 -2
  222. package/frontend/dist/js/id-DlMHjjy0.js +0 -2
  223. package/frontend/dist/js/is-B9E_a7dG.js +0 -2
  224. package/frontend/dist/js/it-DawmVbLC.js +0 -2
  225. package/frontend/dist/js/ja-DmVvwY3W.js +0 -2
  226. package/frontend/dist/js/ko-DzOPpkVs.js +0 -2
  227. package/frontend/dist/js/ms-DpsaOPht.js +0 -2
  228. package/frontend/dist/js/nl-B1d8W22n.js +0 -2
  229. package/frontend/dist/js/pl-nCncRVgt.js +0 -2
  230. package/frontend/dist/js/pt-DHw8fGuu.js +0 -2
  231. package/frontend/dist/js/ru-Derl_YP_.js +0 -2
  232. package/frontend/dist/js/sv-pJAfBVo0.js +0 -2
  233. package/frontend/dist/js/th-C_7fIGnk.js +0 -2
  234. package/frontend/dist/js/tr-CPqsJvaP.js +0 -2
  235. package/frontend/dist/js/uk-3o8P_kFi.js +0 -2
  236. package/frontend/dist/js/vi-Dv6N7OVD.js +0 -2
  237. package/frontend/dist/js/zh-qg5iqtPi.js +0 -2
@@ -0,0 +1,134 @@
1
+ /*
2
+ * Libre WebUI
3
+ * Copyright (C) 2025 Kroonen AI, Inc.
4
+ *
5
+ * Licensed under the Apache License, Version 2.0 (the "License");
6
+ * you may not use this file except in compliance with the License.
7
+ * You may obtain a copy of the License at:
8
+ *
9
+ * http://www.apache.org/licenses/LICENSE-2.0
10
+ *
11
+ * Unless required by applicable law or agreed to in writing, software
12
+ * distributed under the License is distributed on an "AS IS" BASIS,
13
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14
+ * See the License for the specific language governing permissions and
15
+ * limitations under the License.
16
+ */
17
+ /**
18
+ * Resource-grant management (IAM-03). Owners (and grant-admins) manage
19
+ * shares on their own resources; a user can always list what is shared
20
+ * with them and leave a share.
21
+ */
22
+ import express from 'express';
23
+ import rateLimit from '../middleware/sharedRateLimit.js';
24
+ import { authenticate } from '../middleware/auth.js';
25
+ import { createGrant, deleteGrant, listGrantsForActor, listGrantsForResource, ResourceGrantError, } from '../services/resourceGrantService.js';
26
+ import { createLogger } from '../utils/logger.js';
27
+ const router = express.Router();
28
+ const logger = createLogger('access-routes');
29
+ const accessRateLimiter = rateLimit({
30
+ keyPrefix: 'resource-access',
31
+ windowMs: 15 * 60 * 1000,
32
+ max: 240,
33
+ message: { success: false, message: 'Too many requests' },
34
+ standardHeaders: true,
35
+ legacyHeaders: false,
36
+ });
37
+ router.use(accessRateLimiter, authenticate);
38
+ const actorOf = (req) => ({
39
+ userId: req.user.userId,
40
+ role: req.user.role,
41
+ });
42
+ const handleError = (res, error, fallback) => {
43
+ if (error instanceof ResourceGrantError) {
44
+ res
45
+ .status(error.statusCode)
46
+ .json({ success: false, message: error.message });
47
+ return;
48
+ }
49
+ logger.error(fallback, error);
50
+ res.status(500).json({ success: false, message: 'Internal server error' });
51
+ };
52
+ const publicGrant = (grant) => ({
53
+ id: grant.id,
54
+ resourceType: grant.resource_type,
55
+ resourceId: grant.resource_id,
56
+ principalType: grant.principal_type,
57
+ principalId: grant.principal_id,
58
+ permission: grant.permission,
59
+ createdAt: new Date(grant.created_at).toISOString(),
60
+ });
61
+ /** Grants on one of the caller's resources. */
62
+ router.get('/grants', async (req, res) => {
63
+ try {
64
+ const { type, id } = req.query;
65
+ if (typeof type !== 'string' || typeof id !== 'string') {
66
+ res
67
+ .status(400)
68
+ .json({ success: false, message: 'type and id are required' });
69
+ return;
70
+ }
71
+ const grants = await listGrantsForResource(actorOf(req), type, id);
72
+ res.json({ success: true, data: grants.map(publicGrant) });
73
+ }
74
+ catch (error) {
75
+ handleError(res, error, 'Grant list error:');
76
+ }
77
+ });
78
+ /** Share a resource with a user or group. */
79
+ router.post('/grants', async (req, res) => {
80
+ try {
81
+ const { resourceType, resourceId, principalType, principalId, permission } = req.body ?? {};
82
+ for (const [field, value] of Object.entries({
83
+ resourceType,
84
+ resourceId,
85
+ principalType,
86
+ principalId,
87
+ permission,
88
+ })) {
89
+ if (typeof value !== 'string' || !value) {
90
+ res
91
+ .status(400)
92
+ .json({ success: false, message: `${field} is required` });
93
+ return;
94
+ }
95
+ }
96
+ const grant = await createGrant(actorOf(req), {
97
+ resourceType,
98
+ resourceId,
99
+ principalType,
100
+ principalId,
101
+ permission,
102
+ });
103
+ res.status(201).json({ success: true, data: publicGrant(grant) });
104
+ }
105
+ catch (error) {
106
+ handleError(res, error, 'Grant create error:');
107
+ }
108
+ });
109
+ /** Remove a grant (owner, grant-admin, or the granted user leaving). */
110
+ router.delete('/grants/:id', async (req, res) => {
111
+ try {
112
+ const deleted = await deleteGrant(actorOf(req), req.params.id);
113
+ if (!deleted) {
114
+ res.status(404).json({ success: false, message: 'Grant not found' });
115
+ return;
116
+ }
117
+ res.json({ success: true });
118
+ }
119
+ catch (error) {
120
+ handleError(res, error, 'Grant delete error:');
121
+ }
122
+ });
123
+ /** Everything shared with the caller, directly or via groups. */
124
+ router.get('/shared-with-me', async (req, res) => {
125
+ try {
126
+ const grants = await listGrantsForActor(actorOf(req));
127
+ res.json({ success: true, data: grants.map(publicGrant) });
128
+ }
129
+ catch (error) {
130
+ handleError(res, error, 'Shared list error:');
131
+ }
132
+ });
133
+ export default router;
134
+ //# sourceMappingURL=access.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/routes/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;GAIG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,SAAS,MAAM,kCAAkC,CAAC;AACzD,OAAO,EAAE,YAAY,EAAwB,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EACL,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAChC,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAE7C,MAAM,iBAAiB,GAAG,SAAS,CAAC;IAClC,SAAS,EAAE,iBAAiB;IAC5B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,GAAG,EAAE,GAAG;IACR,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE;IACzD,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;CACrB,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;AAE5C,MAAM,OAAO,GAAG,CAAC,GAAyB,EAAc,EAAE,CAAC,CAAC;IAC1D,MAAM,EAAE,GAAG,CAAC,IAAK,CAAC,MAAM;IACxB,IAAI,EAAE,GAAG,CAAC,IAAK,CAAC,IAAI;CACrB,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAClB,GAAqB,EACrB,KAAc,EACd,QAAgB,EACV,EAAE;IACR,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;QACxC,GAAG;aACA,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;aACxB,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAC7E,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,KAQpB,EAAE,EAAE,CAAC,CAAC;IACL,EAAE,EAAE,KAAK,CAAC,EAAE;IACZ,YAAY,EAAE,KAAK,CAAC,aAAa;IACjC,UAAU,EAAE,KAAK,CAAC,WAAW;IAC7B,aAAa,EAAE,KAAK,CAAC,cAAc;IACnC,WAAW,EAAE,KAAK,CAAC,YAAY;IAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;IAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;CACpD,CAAC,CAAC;AAEH,+CAA+C;AAC/C,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IAC7D,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;QAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YACvD,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,6CAA6C;AAC7C,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IAC9D,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,GACxE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;YAC1C,YAAY;YACZ,UAAU;YACV,aAAa;YACb,WAAW;YACX,UAAU;SACX,CAAC,EAAE,CAAC;YACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;gBACxC,GAAG;qBACA,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,cAAc,EAAE,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;YAC5C,YAAY;YACZ,UAAU;YACV,aAAa;YACb,WAAW;YACX,UAAU;SACX,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACjD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,wEAAwE;AACxE,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACpE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACjD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACrE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}
@@ -0,0 +1,3 @@
1
+ declare const router: import("express-serve-static-core").Router;
2
+ export default router;
3
+ //# sourceMappingURL=audit.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/routes/audit.ts"],"names":[],"mappings":"AAuBA,QAAA,MAAM,MAAM,4CAAmB,CAAC;eAkEjB,MAAM"}
@@ -0,0 +1,82 @@
1
+ /*
2
+ * Libre WebUI
3
+ * Copyright (C) 2025 Kroonen AI, Inc.
4
+ *
5
+ * Licensed under the Apache License, Version 2.0 (the "License");
6
+ * you may not use this file except in compliance with the License.
7
+ * You may obtain a copy of the License at:
8
+ *
9
+ * http://www.apache.org/licenses/LICENSE-2.0
10
+ *
11
+ * Unless required by applicable law or agreed to in writing, software
12
+ * distributed under the License is distributed on an "AS IS" BASIS,
13
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14
+ * See the License for the specific language governing permissions and
15
+ * limitations under the License.
16
+ */
17
+ import express from 'express';
18
+ import rateLimit from '../middleware/sharedRateLimit.js';
19
+ import { authenticate, requireAdmin } from '../middleware/auth.js';
20
+ import { queryAuditEvents } from '../services/securityAuditService.js';
21
+ import { createLogger } from '../utils/logger.js';
22
+ const router = express.Router();
23
+ const logger = createLogger('audit-routes');
24
+ const auditRateLimiter = rateLimit({
25
+ keyPrefix: 'security-audit',
26
+ windowMs: 15 * 60 * 1000,
27
+ max: 120,
28
+ message: { success: false, message: 'Too many requests' },
29
+ standardHeaders: true,
30
+ legacyHeaders: false,
31
+ });
32
+ router.use(auditRateLimiter, authenticate, requireAdmin);
33
+ /** Query the security audit log (admin only, redacted at write time). */
34
+ router.get('/', async (req, res) => {
35
+ try {
36
+ const { action, actor, result, targetType, before, after, limit } = req.query;
37
+ const parseEpoch = (value) => {
38
+ if (typeof value !== 'string' || !value)
39
+ return undefined;
40
+ const asNumber = Number(value);
41
+ if (Number.isFinite(asNumber) && asNumber > 0)
42
+ return asNumber;
43
+ const asDate = Date.parse(value);
44
+ return Number.isFinite(asDate) ? asDate : undefined;
45
+ };
46
+ const isResult = (value) => value === 'success' || value === 'denied' || value === 'failure';
47
+ const events = await queryAuditEvents({
48
+ ...(typeof action === 'string' && action ? { action } : {}),
49
+ ...(typeof actor === 'string' && actor ? { actorUserId: actor } : {}),
50
+ ...(isResult(result) ? { result } : {}),
51
+ ...(typeof targetType === 'string' && targetType ? { targetType } : {}),
52
+ ...(parseEpoch(before) !== undefined
53
+ ? { before: parseEpoch(before) }
54
+ : {}),
55
+ ...(parseEpoch(after) !== undefined ? { after: parseEpoch(after) } : {}),
56
+ ...(typeof limit === 'string' && Number.isFinite(Number(limit))
57
+ ? { limit: Number(limit) }
58
+ : {}),
59
+ });
60
+ res.json({
61
+ success: true,
62
+ data: events.map(event => ({
63
+ id: event.id,
64
+ occurredAt: new Date(event.occurred_at).toISOString(),
65
+ actorUserId: event.actor_user_id,
66
+ actorKind: event.actor_kind,
67
+ action: event.action,
68
+ targetType: event.target_type,
69
+ targetId: event.target_id,
70
+ result: event.result,
71
+ requestId: event.request_id,
72
+ details: event.details ? JSON.parse(event.details) : null,
73
+ })),
74
+ });
75
+ }
76
+ catch (error) {
77
+ logger.error('Audit query error:', error);
78
+ res.status(500).json({ success: false, message: 'Internal server error' });
79
+ }
80
+ });
81
+ export default router;
82
+ //# sourceMappingURL=audit.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/routes/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,SAAS,MAAM,kCAAkC,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAChC,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;AAE5C,MAAM,gBAAgB,GAAG,SAAS,CAAC;IACjC,SAAS,EAAE,gBAAgB;IAC3B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,GAAG,EAAE,GAAG;IACR,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE;IACzD,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;CACrB,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAEzD,yEAAyE;AACzE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAC/D,GAAG,CAAC,KAAK,CAAC;QACZ,MAAM,UAAU,GAAG,CAAC,KAAc,EAAsB,EAAE;YACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACtD,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,CACf,KAAc,EAC6B,EAAE,CAC7C,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,CAAC;QAEnE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;YACpC,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,SAAS;gBAClC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAE,EAAE;gBACjC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7D,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;gBAC1B,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACzB,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,UAAU,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;gBACrD,WAAW,EAAE,KAAK,CAAC,aAAa;gBAChC,SAAS,EAAE,KAAK,CAAC,UAAU;gBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,WAAW;gBAC7B,QAAQ,EAAE,KAAK,CAAC,SAAS;gBACzB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,UAAU;gBAC3B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;aAC1D,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;QAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}
@@ -1 +1 @@
1
- {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AA2CA,QAAA,MAAM,MAAM,4CAAmB,CAAC;eAsoBjB,MAAM"}
1
+ {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AAgEA,QAAA,MAAM,MAAM,4CAAmB,CAAC;eAwgCjB,MAAM"}