Source: server/auth/admin.js

  1. /**
  2.  * Auth / Admin
  3.  * @type {module:express-promise-router}
  4.  */
  5. const Router = require("express-promise-router");
  6. const { contract, is } = require("contractis");
  8. const db = require("@saltcorn/data/db");
  9. const User = require("@saltcorn/data/models/user");
  10. const View = require("@saltcorn/data/models/view");
  11. const Field = require("@saltcorn/data/models/field");
  12. const Form = require("@saltcorn/data/models/form");
  13. const {
  14.   mkTable,
  15.   renderForm,
  16.   link,
  17.   post_btn,
  18.   settingsDropdown,
  19.   post_dropdown_item,
  20. } = require("@saltcorn/markup");
  21. const {
  22.   isAdmin,
  23.   setTenant,
  24.   error_catcher,
  25. } = require("../routes/utils");
  26. const { send_reset_email } = require("./resetpw");
  27. const { getState } = require("@saltcorn/data/db/state");
  28. const {
  29.   a,
  30.   div,
  31.   text,
  32.   span,
  33.   code,
  34.   h5,
  35.   i,
  36.   p,
  37. } = require("@saltcorn/markup/tags");
  38. const Table = require("@saltcorn/data/models/table");
  39. const {
  40.   send_users_page,
  41.   config_fields_form,
  42.   save_config_from_form,
  43.   getBaseDomain,
  44.   hostname_matches_baseurl,
  45.   is_hsts_tld,
  46. } = require("../markup/admin");
  47. const { send_verification_email } = require("@saltcorn/data/models/email");
  48. const router = new Router();
  49. module.exports = router;
  51. const getUserFields = async () => {
  52.   const userTable = await Table.findOne({ name: "users" });
  53.   const userFields = (await userTable.getFields()).filter(
  54.     (f) => !f.calculated && f.name !== "id"
  55.   );
  56.   const iterForm = async (cfgField) => {
  57.     const signup_form_name = getState().getConfig(cfgField, "");
  58.     if (signup_form_name) {
  59.       const signup_form = await View.findOne({ name: signup_form_name });
  60.       if (signup_form) {
  61.         (signup_form.configuration.columns || []).forEach((f) => {
  62.           const uf = userFields.find((uff) => uff.name === f.field_name);
  63.           if (uf) {
  64.             uf.fieldview = f.fieldview;
  65.             uf.attributes = { ...f.configuration, ...uf.attributes };
  66.           }
  67.         });
  68.       }
  69.     }
  70.   };
  71.   await iterForm("signup_form");
  72.   await iterForm("new_user_form");
  74.   return userFields;
  75. };
  76. const userForm = contract(
  77.   is.fun(
  78.     [is.obj({}), is.maybe(is.class("User"))],
  79.     is.promise(is.class("Form"))
  80.   ),
  81.   async (req, user) => {
  82.     const roleField = new Field({
  83.       label: req.__("Role"),
  84.       name: "role_id",
  85.       type: "Key",
  86.       reftable_name: "roles",
  87.     });
  88.     const roles = (await User.get_roles()).filter((r) => r.role !== "public");
  89.     roleField.options = roles.map((r) => ({ label: r.role, value: r.id }));
  90.     const can_reset = getState().getConfig("smtp_host", "") !== "";
  91.     const userFields = await getUserFields();
  92.     const form = new Form({
  93.       fields: [roleField, ...userFields],
  94.       action: "/useradmin/save",
  95.       submitLabel: user ? req.__("Save") : req.__("Create"),
  96.     });
  97.     if (!user) {
  98.       form.fields.push(
  99.         new Field({
  100.           label: req.__("Set random password"),
  101.           name: "rnd_password",
  102.           type: "Bool",
  103.           default: true,
  104.         })
  105.       );
  106.       form.fields.push(
  107.         new Field({
  108.           label: req.__("Password"),
  109.           name: "password",
  110.           input_type: "password",
  111.           showIf: { rnd_password: false },
  112.         })
  113.       );
  114.       can_reset &&
  115.         form.fields.push(
  116.           new Field({
  117.             label: req.__("Send password reset email"),
  118.             name: "send_pwreset_email",
  119.             type: "Bool",
  120.             default: true,
  121.             showIf: { rnd_password: true },
  122.           })
  123.         );
  124.     }
  125.     if (user) {
  126.       form.hidden("id");
  127.       form.values = user;
  128.       delete form.values.password;
  129.     } else {
  130.       form.values.role_id = roles[roles.length - 1].id;
  131.     }
  132.     return form;
  133.   }
  134. );
  135. /**
  136.  * Dropdown for User Info in left menu
  137.  * @param user
  138.  * @param req
  139.  * @param can_reset
  140.  * @returns {string}
  141.  */
  142. const user_dropdown = (user, req, can_reset) =>
  143.   settingsDropdown(`dropdownMenuButton${user.id}`, [
  144.     a(
  145.       {
  146.         class: "dropdown-item",
  147.         href: `/useradmin/${user.id}`,
  148.       },
  149.       '<i class="fas fa-edit"></i>&nbsp;' + req.__("Edit")
  150.     ),
  151.     post_dropdown_item(
  152.       `/useradmin/set-random-password/${user.id}`,
  153.       '<i class="fas fa-random"></i>&nbsp;' + req.__("Set random password"),
  154.       req
  155.     ),
  156.     can_reset &&
  157.       post_dropdown_item(
  158.         `/useradmin/reset-password/${user.id}`,
  159.         '<i class="fas fa-envelope"></i>&nbsp;' +
  160.           req.__("Send password reset email"),
  161.         req
  162.       ),
  163.     can_reset &&
  164.       !user.verified_on &&
  165.       getState().getConfig("verification_view", "") &&
  166.       post_dropdown_item(
  167.         `/useradmin/send-verification/${user.id}`,
  168.         '<i class="fas fa-envelope"></i>&nbsp;' +
  169.           req.__("Send verification email"),
  170.         req
  171.       ),
  172.     user.disabled &&
  173.       post_dropdown_item(
  174.         `/useradmin/enable/${user.id}`,
  175.         '<i class="fas fa-play"></i>&nbsp;' + req.__("Enable"),
  176.         req
  177.       ),
  178.     !user.disabled &&
  179.       post_dropdown_item(
  180.         `/useradmin/disable/${user.id}`,
  181.         '<i class="fas fa-pause"></i>&nbsp;' + req.__("Disable"),
  182.         req
  183.       ),
  184.     div({ class: "dropdown-divider" }),
  185.     post_dropdown_item(
  186.       `/useradmin/delete/${user.id}`,
  187.       '<i class="far fa-trash-alt"></i>&nbsp;' + req.__("Delete"),
  188.       req,
  189.       true,
  190.       user.email
  191.     ),
  192.   ]);
  194. router.get(
  195.   "/",
  196.   setTenant,
  197.   isAdmin,
  198.   error_catcher(async (req, res) => {
  199.     const users = await User.find({}, { orderBy: "id" });
  200.     const roles = await User.get_roles();
  201.     var roleMap = {};
  202.     roles.forEach((r) => {
  203.       roleMap[r.id] = r.role;
  204.     });
  205.     const can_reset = getState().getConfig("smtp_host", "") !== "";
  206.     send_users_page({
  207.       res,
  208.       req,
  209.       active_sub: "Users",
  210.       contents: {
  211.         type: "card",
  212.         title: req.__("Users"),
  213.         contents: [
  214.           mkTable(
  215.             [
  216.               { label: req.__("ID"), key: "id" },
  217.               {
  218.                 label: req.__("Email"),
  219.                 key: (r) => link(`/useradmin/${r.id}`, r.email),
  220.               },
  221.               {
  222.                 label: "",
  223.                 key: (r) =>
  224.                   r.disabled
  225.                     ? span({ class: "badge badge-danger" }, "Disabled")
  226.                     : "",
  227.               },
  228.               {
  229.                 label: req.__("Verified"),
  230.                 key: (r) =>
  231.                   !!r.verified_on
  232.                     ? i({
  233.                         class: "fas fa-check-circle text-success",
  234.                       })
  235.                     : "",
  236.               },
  237.               { label: req.__("Role"), key: (r) => roleMap[r.role_id] },
  238.               {
  239.                 label: "",
  240.                 key: (r) => user_dropdown(r, req, can_reset),
  241.               },
  242.             ],
  243.             users,
  244.             { hover: true }
  245.           ),
  246.           link(`/useradmin/new`, req.__("Create user")),
  247.         ],
  248.       },
  249.     });
  250.   })
  251. );
  253. router.get(
  254.   "/new",
  255.   setTenant,
  256.   isAdmin,
  257.   error_catcher(async (req, res) => {
  258.     const form = await userForm(req);
  259.     send_users_page({
  260.       res,
  261.       req,
  262.       active_sub: "Users",
  263.       sub2_page: "New",
  264.       contents: {
  265.         type: "card",
  266.         title: req.__("New user"),
  267.         contents: [renderForm(form, req.csrfToken())],
  268.       },
  269.     });
  270.   })
  271. );
  273. const user_settings_form = (req) =>
  274.   config_fields_form({
  275.     req,
  276.     field_names: [
  277.       "allow_signup",
  278.       "login_menu",
  279.       "new_user_form",
  280.       "login_form",
  281.       "signup_form",
  282.       "user_settings_form",
  283.       "verification_view",
  284.       "elevate_verified",
  285.       "min_role_upload",
  286.       "timeout",
  287.       "email_mask",
  288.       "allow_forgot",
  289.       "cookie_sessions",
  290.       "custom_http_headers",
  291.     ],
  292.     action: "/useradmin/settings",
  293.     submitLabel: req.__("Save"),
  294.   });
  295. router.get(
  296.   "/settings",
  297.   setTenant,
  298.   isAdmin,
  299.   error_catcher(async (req, res) => {
  300.     const form = await user_settings_form(req);
  301.     send_users_page({
  302.       res,
  303.       req,
  304.       active_sub: "Settings",
  305.       contents: {
  306.         type: "card",
  307.         title: req.__("Authentication settings"),
  308.         contents: [renderForm(form, req.csrfToken())],
  309.       },
  310.     });
  311.   })
  312. );
  313. router.post(
  314.   "/settings",
  315.   setTenant,
  316.   isAdmin,
  317.   error_catcher(async (req, res) => {
  318.     const form = await user_settings_form(req);
  319.     form.validate(req.body);
  320.     if (form.hasErrors) {
  321.       send_users_page({
  322.         res,
  323.         req,
  324.         active_sub: "Settings",
  325.         contents: {
  326.           type: "card",
  327.           title: req.__("Authentication settings"),
  328.           contents: [renderForm(form, req.csrfToken())],
  329.         },
  330.       });
  331.     } else {
  332.       await save_config_from_form(form);
  333.       req.flash("success", req.__("User settings updated"));
  334.       res.redirect("/useradmin/settings");
  335.     }
  336.   })
  337. );
  339. router.get(
  340.   "/ssl",
  341.   setTenant,
  342.   isAdmin,
  343.   error_catcher(async (req, res) => {
  344.     const isRoot = db.getTenantSchema() === db.connectObj.default_schema;
  345.     if (!isRoot) {
  346.       req.flash(
  347.         "warning",
  348.         req.__("SSL settings not available for subdomain tenants")
  349.       );
  350.       res.redirect("/useradmin");
  351.       return;
  352.     }
  353.     // TBD describe logic around letsencrypt
  354.     const letsencrypt = getState().getConfig("letsencrypt", false);
  355.     const has_custom =
  356.       getState().getConfig("custom_ssl_certificate", false) &&
  357.       getState().getConfig("custom_ssl_private_key", false);
  358.     const show_warning =
  359.       !hostname_matches_baseurl(req, getBaseDomain()) &&
  360.       is_hsts_tld(getBaseDomain());
  361.     send_users_page({
  362.       res,
  363.       req,
  364.       active_sub: "SSL",
  365.       contents: {
  366.         above: [
  367.           ...(letsencrypt && has_custom
  368.             ? [
  369.                 {
  370.                   type: "card",
  371.                   contents: p(
  372.                     req.__(
  373.                       "You have enabled both Let's Encrypt certificates and custom SSL certificates. Let's Encrypt takes priority and the custom certificates will be ignored."
  374.                     )
  375.                   ),
  376.                 },
  377.               ]
  378.             : []),
  379.           {
  380.             type: "card",
  381.             title: req.__(
  382.               "HTTPS encryption with Let's Encrypt SSL certificate"
  383.             ),
  384.             contents: [
  385.               p(
  386.                 req.__(
  387.                   `Saltcorn can automatically obtain an SSL certificate from <a href="https://letsencrypt.org/">Let's Encrypt</a> for single domains`
  388.                 )
  389.               ),
  390.               h5(
  391.                 req.__("Currently: "),
  392.                 letsencrypt
  393.                   ? span({ class: "badge badge-primary" }, req.__("Enabled"))
  394.                   : span({ class: "badge badge-secondary" }, req.__("Disabled"))
  395.               ),
  396.               letsencrypt
  397.                 ? post_btn(
  398.                     "/config/delete/letsencrypt",
  399.                     req.__("Disable LetsEncrypt HTTPS"),
  400.                     req.csrfToken(),
  401.                     { btnClass: "btn-danger", req }
  402.                   )
  403.                 : post_btn(
  404.                     "/admin/enable-letsencrypt",
  405.                     req.__("Enable LetsEncrypt HTTPS"),
  406.                     req.csrfToken(),
  407.                     { confirm: true, req }
  408.                   ),
  409.               !letsencrypt &&
  410.                 show_warning &&
  411.                 !has_custom &&
  412.                 div(
  413.                   { class: "mt-3 alert alert-danger" },
  414.                   p(
  415.                       req.__(
  416.                           "The address you are using to reach Saltcorn does not match the Base URL."
  417.                       )
  418.                   ),
  419.                   p(
  420.                       req.__(
  421.                           "The DNS A records (for * and @, or a subdomain) should point to this server's IP address before enabling LetsEncrypt"
  422.                       )
  423.                   )
  424.                 ),
  425.             ],
  426.           },
  427.           {
  428.             type: "card",
  429.             title: req.__("HTTPS encryption with custom SSL certificate"),
  430.             contents: [
  431.               p(
  432.                 req.__(
  433.                   `Or use custom SSL certificates, including wildcard certificates for multitenant applications`
  434.                 )
  435.               ),
  436.               h5(
  437.                 req.__("Currently: "),
  438.                 has_custom
  439.                   ? span({ class: "badge badge-primary" }, req.__("Enabled"))
  440.                   : span({ class: "badge badge-secondary" }, req.__("Disabled"))
  441.               ),
  442.                 // TBD change to button
  443.               link("/useradmin/ssl/custom", req.__("Edit custom SSL certificates")),
  444.             ],
  445.           },
  446.         ],
  447.       },
  448.     });
  449.   })
  450. );
  452. const ssl_form = (req) =>
  453.   config_fields_form({
  454.     req,
  455.     field_names: ["custom_ssl_certificate", "custom_ssl_private_key"],
  456.     action: "/useradmin/ssl/custom",
  457.   });
  458. router.get(
  459.   "/ssl/custom",
  460.   setTenant,
  461.   isAdmin,
  462.   error_catcher(async (req, res) => {
  463.     const form = await ssl_form(req);
  464.     send_users_page({
  465.       res,
  466.       req,
  467.       active_sub: "Settings",
  468.       contents: {
  469.         type: "card",
  470.         title: req.__("Authentication settings"),
  471.         sub2_page: req.__("Custom SSL certificates"),
  472.         contents: [renderForm(form, req.csrfToken())],
  473.       },
  474.     });
  475.   })
  476. );
  477. router.post(
  478.   "/ssl/custom",
  479.   setTenant,
  480.   isAdmin,
  481.   error_catcher(async (req, res) => {
  482.     const form = await ssl_form(req);
  483.     form.validate(req.body);
  484.     if (form.hasErrors) {
  485.       send_users_page({
  486.         res,
  487.         req,
  488.         active_sub: "Settings",
  489.         contents: {
  490.           type: "card",
  491.           title: req.__("Authentication settings"),
  492.           sub2_page: req.__("Custom SSL certificates"),
  493.           contents: [renderForm(form, req.csrfToken())],
  494.         },
  495.       });
  496.     } else {
  497.       await save_config_from_form(form);
  498.       req.flash(
  499.         "success",
  500.         req.__("Custom SSL enabled. Restart for changes to take effect.") +
  501.           " " +
  502.           a({ href: "/admin/system" }, req.__("Restart here"))
  503.       );
  504.       res.redirect("/useradmin/ssl");
  505.     }
  506.   })
  507. );
  508. router.get(
  509.   "/:id",
  510.   setTenant,
  511.   isAdmin,
  512.   error_catcher(async (req, res) => {
  513.     const { id } = req.params;
  514.     const user = await User.findOne({ id });
  515.     const form = await userForm(req, user);
  517.     send_users_page({
  518.       res,
  519.       req,
  520.       active_sub: "Users",
  521.       sub2_page: user.email,
  522.       contents: {
  523.         above: [
  524.           {
  525.             type: "card",
  526.             title: req.__("Edit user %s", user.email),
  527.             contents: renderForm(form, req.csrfToken()),
  528.           },
  529.           {
  530.             type: "card",
  531.             title: req.__("API token"),
  532.             contents: [
  533.               // api token for user
  534.               div(
  535.                 user.api_token
  536.                   ? span({ class: "mr-1" }, req.__("API token for this user: ")) +
  537.                       code(user.api_token)
  538.                   : req.__("No API token issued")
  539.               ),
  540.               // button for reset or generate api token
  541.               div(
  542.                 { class: "mt-4" },
  543.                 post_btn(
  544.                   `/useradmin/gen-api-token/${user.id}`,
  545.                   user.api_token ? req.__("Reset") : req.__("Generate"),
  546.                   req.csrfToken()
  547.                 )
  548.               ),
  549.               // button for remove api token
  550.               user.api_token && div(
  551.                   { class: "mt-4" },
  552.                   post_btn(
  553.                       `/useradmin/remove-api-token/${user.id}`,
  554.                       // TBD localization
  555.                       user.api_token ? req.__("Remove") : req.__("Generate"),
  556.                       req.csrfToken(),
  557.                       { req: req, confirm: true }
  558.                   )
  559.                 ),
  560.             ],
  561.           },
  562.         ],
  563.       },
  564.     });
  565.   })
  566. );
  567. /**
  568.  * Save user data
  569.  */
  570. router.post(
  571.   "/save",
  572.   setTenant,
  573.   isAdmin,
  574.   error_catcher(async (req, res) => {
  575.     let {
  576.       email,
  577.       password,
  578.       role_id,
  579.       id,
  580.       rnd_password,
  581.       send_pwreset_email,
  582.       _csrf,
  583.       ...rest
  584.     } = req.body;
  585.     if (id) {
  586.       try {
  587.         await db.update("users", { email, role_id, ...rest }, id);
  588.         req.flash("success", req.__(`User %s saved`, email));
  589.       } catch (e) {
  590.         req.flash("error", req.__(`Error editing user: %s`, e.message));
  591.       }
  592.     } else {
  593.       if (rnd_password) password = User.generate_password();
  594.       const u = await User.create({
  595.         email,
  596.         password,
  597.         role_id: +role_id,
  598.         ...rest,
  599.       });
  600.       const pwflash =
  601.         rnd_password && !send_pwreset_email
  602.           ? req.__(` with password %s`, code(password))
  603.           : "";
  604.       if (u.error) req.flash("error", u.error);
  605.       else req.flash("success", req.__(`User %s created`, email) + pwflash);
  606.       if (rnd_password && send_pwreset_email) await send_reset_email(u, req);
  607.     }
  608.     res.redirect(`/useradmin`);
  609.   })
  610. );
  611. /**
  612.  * Reset password for yser
  613.  */
  614. router.post(
  615.   "/reset-password/:id",
  616.   setTenant,
  617.   isAdmin,
  618.   error_catcher(async (req, res) => {
  619.     const { id } = req.params;
  620.     const u = await User.findOne({ id });
  621.     await send_reset_email(u, req);
  622.     req.flash("success", req.__(`Reset password link sent to %s`, u.email));
  624.     res.redirect(`/useradmin`);
  625.   })
  626. );
  627. /**
  628.  * Send verification email for user
  629.  */
  630. router.post(
  631.   "/send-verification/:id",
  632.   setTenant,
  633.   isAdmin,
  634.   error_catcher(async (req, res) => {
  635.     const { id } = req.params;
  636.     const u = await User.findOne({ id });
  637.     const result = await send_verification_email(u);
  638.     console.log(result);
  639.     if (result.error) req.flash("danger", result.error);
  640.     else
  641.       req.flash(
  642.         "success",
  643.         req.__(`Email verification link sent to %s`, u.email)
  644.       );
  646.     res.redirect(`/useradmin`);
  647.   })
  648. );
  649. /**
  650.  * Get new api token
  651.  */
  652. router.post(
  653.   "/gen-api-token/:id",
  654.   setTenant,
  655.   isAdmin,
  656.   error_catcher(async (req, res) => {
  657.     const { id } = req.params;
  658.     const u = await User.findOne({ id });
  659.     await u.getNewAPIToken();
  660.     req.flash("success", req.__(`New API token generated`));
  662.     res.redirect(`/useradmin/${u.id}`);
  663.   })
  664. );
  665. /**
  666.  * Remove api token
  667.  */
  668. router.post(
  669.     "/remove-api-token/:id",
  670.     setTenant,
  671.     isAdmin,
  672.     error_catcher(async (req, res) => {
  673.         const { id } = req.params;
  674.         const u = await User.findOne({ id });
  675.         await u.removeAPIToken();
  676.         req.flash("success", req.__(`API token removed`));
  678.         res.redirect(`/useradmin/${u.id}`);
  679.     })
  680. );
  681. /**
  682.  * Set random password
  683.  */
  684. router.post(
  685.   "/set-random-password/:id",
  686.   setTenant,
  687.   isAdmin,
  688.   error_catcher(async (req, res) => {
  689.     const { id } = req.params;
  690.     const u = await User.findOne({ id });
  691.     const newpw = User.generate_password();
  692.     await u.changePasswordTo(newpw);
  693.     await u.destroy_sessions();
  694.     req.flash(
  695.       "success",
  696.       req.__(`Changed password for user %s to %s`, u.email, newpw)
  697.     );
  699.     res.redirect(`/useradmin`);
  700.   })
  701. );
  703. router.post(
  704.   "/disable/:id",
  705.   setTenant,
  706.   isAdmin,
  707.   error_catcher(async (req, res) => {
  708.     const { id } = req.params;
  709.     const u = await User.findOne({ id });
  710.     await u.update({ disabled: true });
  711.     await u.destroy_sessions();
  712.     req.flash("success", req.__(`Disabled user %s`, u.email));
  713.     res.redirect(`/useradmin`);
  714.   })
  715. );
  717. router.post(
  718.   "/enable/:id",
  719.   setTenant,
  720.   isAdmin,
  721.   error_catcher(async (req, res) => {
  722.     const { id } = req.params;
  723.     const u = await User.findOne({ id });
  724.     await u.update({ disabled: false });
  725.     req.flash("success", req.__(`Enabled user %s`, u.email));
  726.     res.redirect(`/useradmin`);
  727.   })
  728. );
  730. router.post(
  731.   "/delete/:id",
  732.   setTenant,
  733.   isAdmin,
  734.   error_catcher(async (req, res) => {
  735.     const { id } = req.params;
  736.     const u = await User.findOne({ id });
  737.     await u.delete();
  738.     req.flash("success", req.__(`User %s deleted`, u.email));
  740.     res.redirect(`/useradmin`);
  741.   })
  742. );