388 lines
18 KiB
JavaScript
388 lines
18 KiB
JavaScript
// ═══════════════════════════════════════════════════════════════════════════════
|
|
// V2 — главный роутер (монтируется в server.js как /v2)
|
|
//
|
|
// ЭТО: createV2Router() — собирает все v2-роутеры в один.
|
|
// ЗАЧЕМ: единственная точка входа v2 в основное приложение.
|
|
//
|
|
// МОНТАЖ В ОСНОВНОМ server.js:
|
|
// const { createV2Router } = require('./v2/server');
|
|
// app.use('/v2', createV2Router());
|
|
//
|
|
// ПОРЯДОК МАРШРУТОВ (важен!):
|
|
// 1. /login — редирект на основной OIDC-вход
|
|
// 2. /iam — отладка IAM-данных из сессии
|
|
// 3. /app — CRUD юзера (resolveContext + user роутер)
|
|
// 4. /admin — админка (resolveContext + admin роутер)
|
|
// 5. /test — тестовый API (если ENABLE_TEST_API !== 'false')
|
|
// 6. /logout — редирект на основной выход
|
|
//
|
|
// ВАЖНО: роутеры /app и /admin используют resolveContext middleware,
|
|
// которое проверяет сессию и выставляет req.clientId, req.email, ...
|
|
// ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
'use strict';
|
|
|
|
const express = require('express');
|
|
const config = require('./src/config');
|
|
const auth = require('./src/auth');
|
|
const { resolveContext } = require('./src/router');
|
|
const { createUserRouter } = require('./src/user');
|
|
const { createAdminRouter } = require('./src/admin');
|
|
const { pool } = require('./src/db');
|
|
const { ensureSchema } = require('./src/db/schema');
|
|
const { mutationLimiter, exportLimiter } = require('../src/middleware/rateLimit');
|
|
|
|
function createV2Router({ generateCsrfToken, doubleCsrfProtection } = {}) {
|
|
// Автосоздание таблиц v2_companies, v2_entries, v2_audit при старте
|
|
ensureSchema(pool).catch(e => console.error('[v2:db] Schema error:', e.message));
|
|
|
|
const router = express.Router();
|
|
|
|
// ── GET /v2/login — редирект на основной вход (KC OIDC) ─────────────
|
|
router.get('/login', (req, res) => {
|
|
res.redirect('/login?returnTo=' + encodeURIComponent('/v2/app'));
|
|
});
|
|
|
|
// ── GET /v2/iam — отладка: IAM-данные из сессии (только админ) ────
|
|
router.get('/iam', resolveContext, (req, res) => {
|
|
if (!req.canAdmin) return res.status(403).send('Доступ запрещён');
|
|
const u = req.session && req.session.user;
|
|
res.send(debugPage(u, config.version));
|
|
});
|
|
|
|
// ── GET /v2/iam_response — сырой ответ IAM (только админ) ─────────
|
|
router.get('/iam_response', resolveContext, async (req, res) => {
|
|
if (!req.canAdmin) return res.status(403).send('Доступ запрещён');
|
|
const token = req.session && req.session.token;
|
|
if (!token) return res.redirect('/v2/login');
|
|
try {
|
|
const mainAuth = require('../src/auth');
|
|
const iamData = await mainAuth.fetchIamUser(token);
|
|
res.set('Content-Type', 'text/html; charset=utf-8');
|
|
res.send(rawPage('IAM PROD', iamData.raw));
|
|
} catch (e) {
|
|
res.send('<h2>Ошибка IAM</h2><pre>' + e.message + '</pre>');
|
|
}
|
|
});
|
|
|
|
// ── GET /v2/db-status — диагностика подключения к PG ─────────────
|
|
router.get('/db-status', async (req, res) => {
|
|
const dns = require('dns').promises;
|
|
const { pool } = require('./src/db');
|
|
const host = process.env.DB_HOST || 'localhost';
|
|
const port = process.env.DB_PORT || 5432;
|
|
const db = process.env.DB_NAME || 'ipwhitelist';
|
|
const user = process.env.DB_USER || 'super';
|
|
|
|
const info = {
|
|
env: {
|
|
DB_HOST: host,
|
|
DB_PORT: port,
|
|
DB_NAME: db,
|
|
DB_USER: user,
|
|
DB_PASS: process.env.DB_PASS ? '***' : 'NOT SET',
|
|
APP_ENV: process.env.APP_ENV || 'production',
|
|
},
|
|
dns: { host, ok: false, ips: [] },
|
|
connect: { ok: false, ms: 0, error: null },
|
|
query: { ok: false, ms: 0, error: null },
|
|
pool: { total: pool.totalCount, idle: pool.idleCount, waiting: pool.waitingCount },
|
|
pg_version: null,
|
|
tables: [],
|
|
};
|
|
|
|
// DNS
|
|
try {
|
|
info.dns.ips = await dns.resolve4(host, { ttl: true });
|
|
info.dns.ok = info.dns.ips.length > 0;
|
|
} catch (e) {
|
|
info.dns.error = e.message;
|
|
}
|
|
|
|
// Connect + query
|
|
try {
|
|
const start = Date.now();
|
|
const r = await pool.query('SELECT version() AS v, current_timestamp AS ts');
|
|
info.connect = { ok: true, ms: Date.now() - start };
|
|
info.pg_version = r.rows[0].v;
|
|
info.server_time = r.rows[0].ts;
|
|
} catch (e) {
|
|
info.connect = { ok: false, ms: Date.now() - start, error: e.message };
|
|
}
|
|
|
|
// Tables
|
|
if (info.connect.ok) {
|
|
try {
|
|
const tables = await pool.query(`
|
|
SELECT table_name,
|
|
(SELECT COUNT(*) FROM information_schema.columns WHERE table_name = t.table_name) AS cols
|
|
FROM information_schema.tables t
|
|
WHERE table_schema='public' AND table_type='BASE TABLE'
|
|
ORDER BY table_name
|
|
`);
|
|
for (const t of tables.rows) {
|
|
const cnt = await pool.query('SELECT COUNT(*)::int AS c FROM ' + t.table_name);
|
|
info.tables.push({ table: t.table_name, columns: t.cols, rows: cnt.rows[0].c });
|
|
}
|
|
} catch (e) {
|
|
info.tables = [{ error: e.message }];
|
|
}
|
|
}
|
|
|
|
// Pool stats
|
|
info.pool = { total: pool.totalCount, idle: pool.idleCount, waiting: pool.waitingCount };
|
|
|
|
res.set('Content-Type', 'text/html; charset=utf-8');
|
|
res.send(renderDbStatus(info));
|
|
});
|
|
|
|
// ── GET /v2/iam-gateway-test — сравнение API (только админ) ────────
|
|
router.get('/iam-gateway-test', resolveContext, async (req, res) => {
|
|
if (!req.canAdmin) return res.status(403).send('Доступ запрещён');
|
|
const token = req.session && req.session.token;
|
|
if (!token) return res.redirect('/v2/login');
|
|
|
|
const base = config.iamApiBase;
|
|
const tests = [
|
|
{
|
|
name: 'auth-api /auth/user',
|
|
url: base + '/auth/user',
|
|
},
|
|
{
|
|
name: 'lk-api-gateway /iam/auth/user',
|
|
url: 'https://lk-api-gateway.ngcloud.ru/api/v1/iam/auth/user',
|
|
},
|
|
{
|
|
name: 'auth-api /impersonation/status',
|
|
url: base + '/impersonation/status',
|
|
},
|
|
];
|
|
|
|
const results = {};
|
|
for (const t of tests) {
|
|
try {
|
|
const data = await iamFetch(token, t.url);
|
|
results[t.name] = { ok: true, data };
|
|
} catch (e) {
|
|
results[t.name] = { ok: false, error: e.message };
|
|
}
|
|
}
|
|
|
|
res.set('Content-Type', 'text/html; charset=utf-8');
|
|
res.send(iamComparePage(results));
|
|
});
|
|
|
|
// ── /v2/app — пользовательский CRUD (только с сессией) ──────────────
|
|
router.use('/app', mutationLimiter, resolveContext, doubleCsrfProtection || ((req,res,next)=>next()), createUserRouter({ generateCsrfToken }));
|
|
|
|
// ── /v2/admin — админка: лимиты + аудит ──────────────────────────
|
|
router.use('/admin', mutationLimiter, resolveContext, doubleCsrfProtection || ((req,res,next)=>next()), createAdminRouter({ generateCsrfToken }));
|
|
|
|
// ── GET /v2/ — редирект на /v2/app ──────────────────────────────────
|
|
router.get('/', (req, res) => res.redirect('/v2/app'));
|
|
|
|
// ── /v2/test — тестовый API (только для ADMIN_EMAIL) ────────────
|
|
if (process.env.ENABLE_TEST_API !== 'false') {
|
|
const { createTestRouter } = require('./src/test');
|
|
router.use('/test', resolveContext, (req, res, next) => {
|
|
if (req.email !== (process.env.ADMIN_EMAIL || '')) return res.status(403).send('Доступ запрещён');
|
|
next();
|
|
}, createTestRouter());
|
|
}
|
|
|
|
// ── /v2/export — выгрузка CIDR (только для админов) ─────────────
|
|
const { createExportRouter } = require('./src/export');
|
|
router.use('/export', exportLimiter, resolveContext, (req, res, next) => {
|
|
if (!req.canAdmin) return res.status(403).send('Доступ запрещён — только для администраторов');
|
|
next();
|
|
}, createExportRouter());
|
|
|
|
// ── GET /v2/logout — выход только из whitelist (без KC SSO) ─────────
|
|
router.get('/logout', (req, res) => {
|
|
const ua = (req.headers['user-agent'] || '').toLowerCase();
|
|
const isBrowser = ua.includes('mozilla') || ua.includes('chrome') || ua.includes('safari');
|
|
if (!isBrowser) {
|
|
req.session.destroy(() => res.redirect('/v2/login'));
|
|
return;
|
|
}
|
|
|
|
if (req.query.confirm === 'yes') {
|
|
req.session.destroy(() => {
|
|
res.set('Content-Type', 'text/html; charset=utf-8');
|
|
res.send('<!DOCTYPE html><html><head><meta charset="utf-8"><title>Выход</title>'
|
|
+ '<style>body{font-family:sans-serif;background:#111;color:#eee;padding:60px;text-align:center}'
|
|
+ 'h2{color:#4fc3f7}p{font-size:18px;margin:20px 0}a{color:#80cbc4;font-size:16px}'
|
|
+ '</style></head><body>'
|
|
+ '<h2>Вы вышли из сервиса</h2>'
|
|
+ '<p>Сессия whitelist завершена.<br>Сессия в других сервисах Nubes сохранена.</p>'
|
|
+ '<a href="/v2/app">Войти снова</a>'
|
|
+ '</body></html>');
|
|
});
|
|
return;
|
|
}
|
|
|
|
res.set('Content-Type', 'text/html; charset=utf-8');
|
|
res.send('<!DOCTYPE html><html><head><meta charset="utf-8"><title>Выход</title>'
|
|
+ '<style>body{font-family:sans-serif;background:#111;color:#eee;padding:40px;text-align:center}'
|
|
+ 'h2{color:#4fc3f7}p{font-size:16px;margin:20px 0}'
|
|
+ '.btn{display:inline-block;padding:12px 24px;margin:0 10px;border-radius:6px;text-decoration:none;font-size:16px}'
|
|
+ '.btn-yes{background:#ef5350;color:#fff}.btn-no{background:#333;color:#eee}'
|
|
+ '</style></head><body>'
|
|
+ '<h2>Выход из сервиса</h2>'
|
|
+ '<p>Вы будете выведены только из whitelist.<br>Сессия в других сервисах Nubes сохранится.</p>'
|
|
+ '<a href="/v2/logout?confirm=yes" class="btn btn-yes">Выйти</a>'
|
|
+ '<a href="/v2/app" class="btn btn-no">Отмена</a>'
|
|
+ '</body></html>');
|
|
});
|
|
|
|
return router;
|
|
}
|
|
|
|
// ── Хелпер: HTTP-запрос к IAM ────────────────────────────────────────────────
|
|
async function iamFetch(token, url) {
|
|
const https = require('https');
|
|
const u = new URL(url);
|
|
return new Promise((resolve, reject) => {
|
|
const req = https.get({
|
|
hostname: u.hostname, port: 443, path: u.pathname,
|
|
headers: { Authorization: 'Bearer ' + token, Accept: 'application/json' },
|
|
}, res => {
|
|
let data = '';
|
|
res.on('data', c => data += c);
|
|
res.on('end', () => {
|
|
if (res.statusCode !== 200) return reject(new Error(res.statusCode + ': ' + data.slice(0, 200)));
|
|
try { resolve(JSON.parse(data)); } catch (e) { reject(e); }
|
|
});
|
|
});
|
|
req.on('error', reject);
|
|
req.setTimeout(5000, () => { req.destroy(); reject(new Error('timeout')); });
|
|
});
|
|
}
|
|
|
|
function rawPage(title, data) {
|
|
return '<!DOCTYPE html>\n<html><head><meta charset="utf-8"><title>' + title + '</title>'
|
|
+ '<style>body{font-family:monospace;background:#111;color:#eee;padding:20px}'
|
|
+ 'pre{background:#1a1a2e;padding:15px;border-radius:8px;overflow-x:auto;font-size:13px}'
|
|
+ 'h2{color:#4fc3f7}a{color:#80cbc4}</style></head><body>'
|
|
+ '<h2>Сырой ответ ' + title + '</h2>'
|
|
+ '<pre>' + JSON.stringify(data, null, 2).replace(/</g, '<') + '</pre>'
|
|
+ '<p><a href="/v2/iam">← Сессия</a> | <a href="/v2/app">CRUD</a></p>'
|
|
+ '</body></html>';
|
|
}
|
|
|
|
function debugPage(u, version) {
|
|
return `<!DOCTYPE html>
|
|
<html><head><meta charset="utf-8"><title>V2 — IAM</title>
|
|
<style>body{font-family:monospace;background:#111;color:#eee;padding:20px}pre{background:#1a1a2e;padding:15px;border-radius:8px}h2{color:#4fc3f7}.label{color:#888}</style></head><body>
|
|
<h2>IAM Response (v${version})</h2>
|
|
<p><span class="label">Email:</span> ${u.email}</p>
|
|
<p><span class="label">clientId:</span> ${u.clientId}</p>
|
|
<p><span class="label">Компания:</span> ${u.companyName}</p>
|
|
<p><span class="label">isAdmin:</span> ${u.isAdmin}</p>
|
|
<p><span class="label">ФИО:</span> ${(u.fio && u.fio.fullName) || u.fio || '—'}</p>
|
|
<p><span class="label">Компаний:</span> ${u.allClientIds ? u.allClientIds.length : 0} — ${(u.allClientIds || []).join(', ')}</p>
|
|
<hr><pre>${JSON.stringify(u, null, 2)}</pre>
|
|
<p><a href="/v2/logout">Выйти</a> | <a href="/v2/app">CRUD</a> | <a href="/v2/admin">Админка</a></p>
|
|
</body></html>`;
|
|
}
|
|
|
|
function iamComparePage(results) {
|
|
function fmt(data, depth) {
|
|
if (data === null || data === undefined) return '<span style="color:#888">null</span>';
|
|
if (typeof data === 'string') return '<span style="color:#ce93d8">"' + data.replace(/</g, '<') + '"</span>';
|
|
if (typeof data === 'number' || typeof data === 'boolean') return '<span style="color:#81c784">' + data + '</span>';
|
|
if (Array.isArray(data)) {
|
|
if (data.length === 0) return '<span style="color:#888">[]</span>';
|
|
let html = '<span style="color:#888">[</span><div style="padding-left:20px">';
|
|
for (const item of data) html += '<div>' + fmt(item, depth + 1) + ',</div>';
|
|
html += '</div><span style="color:#888">]</span>';
|
|
return html;
|
|
}
|
|
if (typeof data === 'object') {
|
|
let html = '<span style="color:#888">{</span><div style="padding-left:20px">';
|
|
for (const [k, v] of Object.entries(data)) {
|
|
html += '<div><span style="color:#82aaff">"' + k + '"</span>: ' + fmt(v, depth + 1) + '</div>';
|
|
}
|
|
html += '</div><span style="color:#888">}</span>';
|
|
return html;
|
|
}
|
|
return String(data).replace(/</g, '<');
|
|
}
|
|
|
|
let html = '<!DOCTYPE html><html><head><meta charset="utf-8"><title>IAM Impersonation</title>';
|
|
html += '<style>body{font-family:monospace;background:#111;color:#eee;padding:20px;font-size:14px}';
|
|
html += 'h2{color:#4fc3f7}.ok{color:#81c784}.err{color:#ef5350}';
|
|
html += '.card{background:#1a1a2e;border-radius:8px;padding:15px;margin-bottom:15px;overflow-x:auto}';
|
|
html += '.card-title{color:#b39ddb;font-size:18px;font-weight:bold;margin-bottom:10px}';
|
|
html += 'a{color:#80cbc4;text-decoration:none}a:hover{text-decoration:underline}';
|
|
html += '.nav{display:flex;gap:15px;margin-bottom:20px;flex-wrap:wrap}';
|
|
html += '.nav a{background:#1a1a2e;padding:8px 16px;border-radius:6px;font-size:14px}';
|
|
html += '</style></head><body>';
|
|
html += '<h2>🧪 IAM Impersonation — GET эндпоинты</h2>';
|
|
html += '<div class="nav">';
|
|
html += '<a href="/v2/iam">← Сессия</a>';
|
|
html += '<a href="/v2/app">CRUD</a>';
|
|
html += '<a href="/v2/admin">Админка</a>';
|
|
html += '<a href="/v2/iam_response">IAM PROD</a>';
|
|
html += '</div>';
|
|
|
|
for (const [name, r] of Object.entries(results)) {
|
|
html += '<div class="card">';
|
|
html += '<div class="card-title">GET /impersonation/' + name + '</div>';
|
|
if (r.ok) {
|
|
html += '<div style="font-family:monospace;white-space:pre-wrap;tab-size:2">';
|
|
html += fmt(r.data, 0);
|
|
html += '</div>';
|
|
} else {
|
|
html += '<div class="err">❌ ' + r.error.replace(/</g, '<') + '</div>';
|
|
}
|
|
html += '</div>';
|
|
}
|
|
|
|
html += '</body></html>';
|
|
return html;
|
|
}
|
|
|
|
function renderDbStatus(info) {
|
|
const ok = info.connect.ok;
|
|
return '<!DOCTYPE html><html><head><meta charset="utf-8"><title>PG Status</title>'
|
|
+ '<style>body{font-family:monospace;background:#111;color:#eee;padding:20px}'
|
|
+ 'h2{color:#4fc3f7}h3{color:#81c784;margin:15px 0 5px}'
|
|
+ '.ok{color:#81c784}.err{color:#ef5350;word-break:break-all}'
|
|
+ 'pre{background:#1a1a2e;padding:10px;border-radius:6px;overflow-x:auto;font-size:12px}'
|
|
+ 'table{border-collapse:collapse;margin:10px 0;font-size:12px}'
|
|
+ 'td,th{border:1px solid #333;padding:4px 10px;text-align:left}'
|
|
+ 'th{color:#888}.label{color:#888}</style></head><body>'
|
|
+ '<h2>⚡ PG Diagnostic <span class="' + (ok ? 'ok' : 'err') + '">' + (ok ? 'OK' : 'FAIL') + '</span></h2>'
|
|
|
|
// Status
|
|
+ '<h3>🔌 Connection</h3>'
|
|
+ '<p><span class="label">Host:</span> ' + info.env.DB_HOST + ':' + info.env.DB_PORT + '</p>'
|
|
+ '<p><span class="label">DB:</span> ' + info.env.DB_NAME + ' / ' + info.env.DB_USER + '</p>'
|
|
+ '<p><span class="label">APP_ENV:</span> ' + info.env.APP_ENV + '</p>'
|
|
+ '<p><span class="' + (ok ? 'ok' : 'err') + '">' + (ok ? '✅ Connected (' + info.connect.ms + 'ms)' : '❌ ' + info.connect.error) + '</span></p>'
|
|
|
|
// DNS
|
|
+ '<h3>🌐 DNS</h3>'
|
|
+ '<p>' + info.dns.ips.map(ip => typeof ip === 'object' ? ip.address : ip).join(', ') + (info.dns.error ? ' <span class="err">' + info.dns.error + '</span>' : '') + '</p>'
|
|
|
|
// Pool
|
|
+ '<h3>🏊 Pool</h3>'
|
|
+ '<p>total=' + info.pool.total + ' idle=' + info.pool.idle + ' waiting=' + info.pool.waiting + '</p>'
|
|
|
|
// PG Info
|
|
+ (info.pg_version ? '<h3>🐘 PostgreSQL</h3><p>' + info.pg_version + '</p><p>Server time: ' + info.server_time + '</p>' : '')
|
|
|
|
// Tables
|
|
+ '<h3>📊 Tables</h3>'
|
|
+ (info.tables.length > 0 && !info.tables[0].error
|
|
? '<table><tr><th>Table</th><th>Cols</th><th>Rows</th></tr>'
|
|
+ info.tables.map(t => '<tr><td>' + t.table + '</td><td>' + t.columns + '</td><td>' + t.rows + '</td></tr>').join('')
|
|
+ '</table>'
|
|
: '<p class="err">' + (info.tables[0] && info.tables[0].error || 'no data') + '</p>')
|
|
|
|
+ '</body></html>';
|
|
}
|
|
|
|
module.exports = { createV2Router };
|