mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

feat(auth): centralize ThothII permission enforcement

Browse Source
This commit is contained in:
marcopan
2026-08-16 17:52:03 +02:00
parent 23ac75ce1d
commit 2e0489ce22
20 changed files with 330 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/routes/pi-management.ts
+5 -34
View File
@@ -1,11 +1,10 @@
import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
import { getPrincipal } from "../auth/auth.js";
import type { AppConfig } from "../config.js";
import { isPrincipalContext, requirePermission } from "../auth/authorization.js";
import { PiManagementError, type PiManagementService } from "../pi/management.js";
export function piManagementRoutes(
app: FastifyInstance,
deps: { config: AppConfig; service: PiManagementService },
deps: { service: PiManagementService },
): void {
app.get("/pi-management/status", async (request, reply) => run(request, reply, deps, () => deps.service.status()));
app.get("/pi-management/options", async (request, reply) => run(request, reply, deps, () => deps.service.options()));
@@ -22,17 +21,11 @@ export function piManagementRoutes(
async function run<T>(
request: FastifyRequest,
reply: FastifyReply,
deps: { config: AppConfig; service: PiManagementService },
deps: { service: PiManagementService },
action: () => Promise<T>,
): Promise<T | FastifyReply> {
const principal = getPrincipal(request);
if (!managementAllowed(deps.config, principal.isAdmin)) {
return reply.code(403).send({ code: "pi_management_forbidden", error: "Pi management is not permitted" });
}
if (deps.config.authMode === "none" && isManagementWrite(request.method)
&& !sameOriginOrNonBrowser(request)) {
return reply.code(403).send({ code: "pi_management_forbidden", error: "Pi management is not permitted" });
}
const principal = requirePermission(request, reply, "pi.manage");
if (!isPrincipalContext(principal)) return principal;
try {
return await action();
} catch (error) {
@@ -43,25 +36,3 @@ async function run<T>(
return reply.code(503).send({ code: "pi_management_unavailable", error: "Pi management is unavailable" });
}
}
function managementAllowed(config: AppConfig, isAdmin: boolean): boolean {
return (config.authMode === "none" && !config.publicExposure)
|| (config.authMode === "upstream" && isAdmin);
}
function isManagementWrite(method: string): boolean {
return method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE";
}
function sameOriginOrNonBrowser(request: FastifyRequest): boolean {
const origin = request.headers.origin;
if (origin === undefined) return true;
if (typeof origin !== "string" || typeof request.headers.host !== "string") return false;
try {
const supplied = new URL(origin);
const expected = new URL(`${request.protocol}://${request.headers.host}`);
return supplied.origin === expected.origin;
} catch {
return false;
}
}