Initial commit after re-install
This commit is contained in:
292
server.js
Normal file
292
server.js
Normal file
@@ -0,0 +1,292 @@
|
||||
import "dotenv/config";
|
||||
import express from "express";
|
||||
import helmet from "helmet";
|
||||
import path from "node:path";
|
||||
import { fileURLToPath } from "node:url";
|
||||
import pg from "pg";
|
||||
import { createRemoteJWKSet, jwtVerify } from "jose";
|
||||
|
||||
const __filename = fileURLToPath(import.meta.url);
|
||||
const __dirname = path.dirname(__filename);
|
||||
|
||||
function env(name, fallback = "") {
|
||||
return (process.env[name] ?? fallback).toString();
|
||||
}
|
||||
|
||||
function must(name) {
|
||||
const v = env(name).trim();
|
||||
if (!v) throw new Error(`Missing env: ${name}`);
|
||||
return v;
|
||||
}
|
||||
|
||||
function safeIdent(s) {
|
||||
const v = String(s || "").trim();
|
||||
if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(v)) throw new Error("Invalid TABLE identifier");
|
||||
return v;
|
||||
}
|
||||
|
||||
function parseCsv(s) {
|
||||
return String(s || "")
|
||||
.split(",")
|
||||
.map((x) => x.trim())
|
||||
.filter(Boolean);
|
||||
}
|
||||
|
||||
function parseEmailCsv(s) {
|
||||
return parseCsv(s).map((x) => x.toLowerCase());
|
||||
}
|
||||
|
||||
const PORT = Number(env("PORT", "8000")) || 8000;
|
||||
const DB_HOST = must("DB_HOST");
|
||||
const DB_PORT = Number(env("DB_PORT", "5432")) || 5432;
|
||||
const DB_NAME = must("DB_NAME");
|
||||
const DB_USER = must("DB_USER");
|
||||
const DB_PASSWORD = must("DB_PASSWORD");
|
||||
const TABLE = safeIdent(env("TABLE", "ncue_user") || "ncue_user");
|
||||
const CONFIG_TABLE = "ncue_app_config";
|
||||
const CONFIG_TOKEN = env("CONFIG_TOKEN", "").trim();
|
||||
const ADMIN_EMAILS = new Set(parseEmailCsv(env("ADMIN_EMAILS", "dosangyoon@gmail.com,dsyoon@ncue.net")));
|
||||
|
||||
// Auth0 config via .env (preferred)
|
||||
const AUTH0_DOMAIN = env("AUTH0_DOMAIN", "").trim();
|
||||
const AUTH0_CLIENT_ID = env("AUTH0_CLIENT_ID", "").trim();
|
||||
const AUTH0_GOOGLE_CONNECTION = env("AUTH0_GOOGLE_CONNECTION", "").trim();
|
||||
|
||||
const pool = new pg.Pool({
|
||||
host: DB_HOST,
|
||||
port: DB_PORT,
|
||||
database: DB_NAME,
|
||||
user: DB_USER,
|
||||
password: DB_PASSWORD,
|
||||
ssl: false,
|
||||
max: 10,
|
||||
});
|
||||
|
||||
const app = express();
|
||||
|
||||
app.use(
|
||||
helmet({
|
||||
contentSecurityPolicy: false, // keep simple for static + Auth0
|
||||
})
|
||||
);
|
||||
app.use(express.json({ limit: "256kb" }));
|
||||
|
||||
app.get("/healthz", async (_req, res) => {
|
||||
try {
|
||||
await pool.query("select 1 as ok");
|
||||
res.json({ ok: true });
|
||||
} catch (e) {
|
||||
res.status(500).json({ ok: false });
|
||||
}
|
||||
});
|
||||
|
||||
function getBearer(req) {
|
||||
const h = req.headers.authorization || "";
|
||||
const m = /^Bearer\s+(.+)$/i.exec(h);
|
||||
return m ? m[1].trim() : "";
|
||||
}
|
||||
|
||||
async function verifyIdToken(idToken, { issuer, audience }) {
|
||||
const jwks = createRemoteJWKSet(new URL(`${issuer}.well-known/jwks.json`));
|
||||
const { payload } = await jwtVerify(idToken, jwks, {
|
||||
issuer,
|
||||
audience,
|
||||
});
|
||||
return payload;
|
||||
}
|
||||
|
||||
async function ensureUserTable() {
|
||||
// Create table if missing + add columns for upgrades
|
||||
await pool.query(`
|
||||
create table if not exists public.${TABLE} (
|
||||
sub text primary key,
|
||||
email text,
|
||||
name text,
|
||||
picture text,
|
||||
provider text,
|
||||
first_login_at timestamptz,
|
||||
last_login_at timestamptz,
|
||||
last_logout_at timestamptz,
|
||||
can_manage boolean not null default false,
|
||||
created_at timestamptz not null default now(),
|
||||
updated_at timestamptz not null default now()
|
||||
)
|
||||
`);
|
||||
await pool.query(`create index if not exists idx_${TABLE}_email on public.${TABLE} (email)`);
|
||||
await pool.query(`alter table public.${TABLE} add column if not exists first_login_at timestamptz`);
|
||||
await pool.query(`alter table public.${TABLE} add column if not exists last_logout_at timestamptz`);
|
||||
}
|
||||
|
||||
async function ensureConfigTable() {
|
||||
await pool.query(`
|
||||
create table if not exists public.${CONFIG_TABLE} (
|
||||
key text primary key,
|
||||
value jsonb not null,
|
||||
updated_at timestamptz not null default now()
|
||||
)
|
||||
`);
|
||||
}
|
||||
|
||||
function isAdminEmail(email) {
|
||||
const e = String(email || "").trim().toLowerCase();
|
||||
return ADMIN_EMAILS.has(e);
|
||||
}
|
||||
|
||||
app.post("/api/auth/sync", async (req, res) => {
|
||||
try {
|
||||
await ensureUserTable();
|
||||
const idToken = getBearer(req);
|
||||
if (!idToken) return res.status(401).json({ ok: false, error: "missing_token" });
|
||||
|
||||
const issuer = String(req.headers["x-auth0-issuer"] || "").trim();
|
||||
const audience = String(req.headers["x-auth0-clientid"] || "").trim();
|
||||
if (!issuer || !audience) return res.status(400).json({ ok: false, error: "missing_auth0_headers" });
|
||||
|
||||
const payload = await verifyIdToken(idToken, { issuer, audience });
|
||||
|
||||
const sub = String(payload.sub || "").trim();
|
||||
const email = payload.email ? String(payload.email).trim().toLowerCase() : null;
|
||||
const name = payload.name ? String(payload.name).trim() : null;
|
||||
const picture = payload.picture ? String(payload.picture).trim() : null;
|
||||
const provider = sub.includes("|") ? sub.split("|", 1)[0] : null;
|
||||
const isAdmin = email ? isAdminEmail(email) : false;
|
||||
|
||||
if (!sub) return res.status(400).json({ ok: false, error: "missing_sub" });
|
||||
|
||||
const q = `
|
||||
insert into public.${TABLE}
|
||||
(sub, email, name, picture, provider, first_login_at, last_login_at, can_manage, updated_at)
|
||||
values
|
||||
($1, $2, $3, $4, $5, now(), now(), $6, now())
|
||||
on conflict (sub) do update set
|
||||
email = excluded.email,
|
||||
name = excluded.name,
|
||||
picture = excluded.picture,
|
||||
provider = excluded.provider,
|
||||
first_login_at = coalesce(public.${TABLE}.first_login_at, excluded.first_login_at),
|
||||
last_login_at = now(),
|
||||
can_manage = (public.${TABLE}.can_manage or $6),
|
||||
updated_at = now()
|
||||
returning can_manage, first_login_at, last_login_at, last_logout_at
|
||||
`;
|
||||
const r = await pool.query(q, [sub, email, name, picture, provider, isAdmin]);
|
||||
const canManage = Boolean(r.rows?.[0]?.can_manage);
|
||||
|
||||
res.json({ ok: true, canManage, user: r.rows?.[0] || null });
|
||||
} catch (e) {
|
||||
res.status(401).json({ ok: false, error: "verify_failed" });
|
||||
}
|
||||
});
|
||||
|
||||
app.post("/api/auth/logout", async (req, res) => {
|
||||
try {
|
||||
await ensureUserTable();
|
||||
const idToken = getBearer(req);
|
||||
if (!idToken) return res.status(401).json({ ok: false, error: "missing_token" });
|
||||
|
||||
const issuer = String(req.headers["x-auth0-issuer"] || "").trim();
|
||||
const audience = String(req.headers["x-auth0-clientid"] || "").trim();
|
||||
if (!issuer || !audience) return res.status(400).json({ ok: false, error: "missing_auth0_headers" });
|
||||
|
||||
const payload = await verifyIdToken(idToken, { issuer, audience });
|
||||
const sub = String(payload.sub || "").trim();
|
||||
if (!sub) return res.status(400).json({ ok: false, error: "missing_sub" });
|
||||
|
||||
const q = `
|
||||
update public.${TABLE}
|
||||
set last_logout_at = now(),
|
||||
updated_at = now()
|
||||
where sub = $1
|
||||
returning last_logout_at
|
||||
`;
|
||||
const r = await pool.query(q, [sub]);
|
||||
res.json({ ok: true, last_logout_at: r.rows?.[0]?.last_logout_at || null });
|
||||
} catch (e) {
|
||||
res.status(401).json({ ok: false, error: "verify_failed" });
|
||||
}
|
||||
});
|
||||
|
||||
// Shared auth config for all browsers (read-only public)
|
||||
app.get("/api/config/auth", async (_req, res) => {
|
||||
try {
|
||||
// Prefer .env config (no UI needed)
|
||||
if (AUTH0_DOMAIN && AUTH0_CLIENT_ID && AUTH0_GOOGLE_CONNECTION) {
|
||||
return res.json({
|
||||
ok: true,
|
||||
value: {
|
||||
auth0: { domain: AUTH0_DOMAIN, clientId: AUTH0_CLIENT_ID },
|
||||
connections: { google: AUTH0_GOOGLE_CONNECTION },
|
||||
adminEmails: [...ADMIN_EMAILS],
|
||||
},
|
||||
updated_at: null,
|
||||
source: "env",
|
||||
});
|
||||
}
|
||||
|
||||
await ensureConfigTable();
|
||||
const r = await pool.query(`select value, updated_at from public.${CONFIG_TABLE} where key = $1`, ["auth"]);
|
||||
if (!r.rows?.length) return res.status(404).json({ ok: false, error: "not_set" });
|
||||
const v = r.rows[0].value || {};
|
||||
// legacy: allowedEmails -> adminEmails
|
||||
if (v && typeof v === "object" && !v.adminEmails && Array.isArray(v.allowedEmails)) {
|
||||
v.adminEmails = v.allowedEmails;
|
||||
}
|
||||
res.json({ ok: true, value: v, updated_at: r.rows[0].updated_at, source: "db" });
|
||||
} catch (e) {
|
||||
res.status(500).json({ ok: false, error: "server_error" });
|
||||
}
|
||||
});
|
||||
|
||||
// Write auth config (protected by CONFIG_TOKEN)
|
||||
app.post("/api/config/auth", async (req, res) => {
|
||||
try {
|
||||
await ensureConfigTable();
|
||||
if (!CONFIG_TOKEN) return res.status(403).json({ ok: false, error: "config_token_not_set" });
|
||||
const token = String(req.headers["x-config-token"] || "").trim();
|
||||
if (token !== CONFIG_TOKEN) return res.status(403).json({ ok: false, error: "forbidden" });
|
||||
|
||||
const body = req.body && typeof req.body === "object" ? req.body : {};
|
||||
const auth0 = body.auth0 && typeof body.auth0 === "object" ? body.auth0 : {};
|
||||
const connections = body.connections && typeof body.connections === "object" ? body.connections : {};
|
||||
// legacy: allowedEmails -> adminEmails
|
||||
const adminEmails = Array.isArray(body.adminEmails)
|
||||
? body.adminEmails
|
||||
: Array.isArray(body.allowedEmails)
|
||||
? body.allowedEmails
|
||||
: [];
|
||||
|
||||
const domain = String(auth0.domain || "").trim();
|
||||
const clientId = String(auth0.clientId || "").trim();
|
||||
const googleConn = String(connections.google || "").trim();
|
||||
const emails = adminEmails.map((x) => String(x).trim().toLowerCase()).filter(Boolean);
|
||||
|
||||
if (!domain || !clientId || !googleConn) {
|
||||
return res.status(400).json({ ok: false, error: "missing_fields" });
|
||||
}
|
||||
|
||||
const value = {
|
||||
auth0: { domain, clientId },
|
||||
connections: { google: googleConn },
|
||||
adminEmails: emails,
|
||||
};
|
||||
|
||||
await pool.query(
|
||||
`insert into public.${CONFIG_TABLE} (key, value, updated_at)
|
||||
values ($1, $2::jsonb, now())
|
||||
on conflict (key) do update set value = excluded.value, updated_at = now()`,
|
||||
["auth", JSON.stringify(value)]
|
||||
);
|
||||
res.json({ ok: true });
|
||||
} catch (e) {
|
||||
res.status(500).json({ ok: false, error: "server_error" });
|
||||
}
|
||||
});
|
||||
|
||||
// Serve static site
|
||||
app.use(express.static(__dirname, { extensions: ["html"] }));
|
||||
|
||||
app.listen(PORT, () => {
|
||||
// eslint-disable-next-line no-console
|
||||
console.log(`listening on http://localhost:${PORT}`);
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user