Merge branch 'master' into dev

packages/node_modules/@node-red/editor-api/lib/admin/index.js

@@ -21,15 +21,17 @@ var flows = require("./flows");
 var flow = require("./flow");
 var context = require("./context");
 var auth = require("../auth");
+var info = require("./settings");
 
 var apiUtil = require("../util");
 
 module.exports = {
-    init: function(runtimeAPI) {
+    init: function(settings,runtimeAPI) {
         flows.init(runtimeAPI);
         flow.init(runtimeAPI);
         nodes.init(runtimeAPI);
         context.init(runtimeAPI);
+        info.init(settings,runtimeAPI);
 
         var needsPermission = auth.needsPermission;
 
@@ -67,6 +69,8 @@ module.exports = {
         // adminApp.delete("/context/:scope(node|flow)/:id",needsPermission("context.write"),context.delete,apiUtil.errorHandler);
         adminApp.delete("/context/:scope(node|flow)/:id/*",needsPermission("context.write"),context.delete,apiUtil.errorHandler);
 
+        adminApp.get("/settings",needsPermission("settings.read"),info.runtimeSettings,apiUtil.errorHandler);
+
         return adminApp;
     }
 }

packages/node_modules/@node-red/editor-api/lib/admin/settings.js

@@ -0,0 +1,72 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+var apiUtils = require("../util");
+var runtimeAPI;
+var settings;
+var theme = require("../editor/theme");
+var clone = require("clone");
+
+var i18n = require("@node-red/util").i18n
+
+function extend(target, source) {
+    var keys = Object.keys(source);
+    var i = keys.length;
+    while(i--) {
+        var value = source[keys[i]]
+        var type = typeof value;
+        if (type === 'string' || type === 'number' || type === 'boolean' || Array.isArray(value)) {
+            target[keys[i]] = value;
+        } else if (value === null) {
+            if (target.hasOwnProperty(keys[i])) {
+                delete target[keys[i]];
+            }
+        } else {
+            // Object
+            if (target.hasOwnProperty(keys[i])) {
+                target[keys[i]] = extend(target[keys[i]],value);
+            } else {
+                target[keys[i]] = value;
+            }
+        }
+    }
+    return target;
+}
+
+module.exports = {
+    init: function(_settings,_runtimeAPI) {
+        runtimeAPI = _runtimeAPI;
+        settings = _settings;
+    },
+    runtimeSettings: function(req,res) {
+        var opts = {
+            user: req.user
+        }
+        runtimeAPI.settings.getRuntimeSettings(opts).then(function(result) {
+            if (!settings.disableEditor) {
+                result.editorTheme = result.editorTheme||{};
+                var themeSettings = theme.settings();
+                if (themeSettings) {
+                    // result.editorTheme may already exist with the palette
+                    // disabled. Need to merge that into the receive settings
+                    result.editorTheme = extend(clone(themeSettings),result.editorTheme);
+                }
+                result.editorTheme.languages = i18n.availableLanguages("editor");
+            }
+            res.json(result);
+        });
+    },
+
+}

packages/node_modules/@node-red/editor-api/lib/auth/strategies.js

@@ -123,38 +123,57 @@ AnonymousStrategy.prototype.authenticate = function(req) {
     });
 }
 
+
+function authenticateUserToken(req) {
+    return new Promise( (resolve,reject) => {
+        var token = null;
+        var tokenHeader = Users.tokenHeader();
+        if (Users.tokenHeader() === null) {
+            // No custom user token provided. Fail the request
+            reject();
+            return;
+        } else if (Users.tokenHeader() === 'authorization') {
+            if (req.headers.authorization && req.headers.authorization.split(' ')[0] === 'Bearer') {
+                token = req.headers.authorization.split(' ')[1];
+            }
+        } else {
+            token = req.headers[Users.tokenHeader()];
+        }
+        if (token) {
+            Users.tokens(token).then(function(user) {
+                if (user) {
+                    resolve(user);
+                } else {
+                    reject();
+                }
+            });
+        } else {
+            reject();
+        }
+    });
+}
+
+
 function TokensStrategy() {
   passport.Strategy.call(this);
   this.name = 'tokens';
 }
 util.inherits(TokensStrategy, passport.Strategy);
 TokensStrategy.prototype.authenticate = function(req) {
-    var self = this;
-    var token = null;
-    if (Users.tokenHeader() === 'authorization') {  
-        if (req.headers.authorization && req.headers.authorization.split(' ')[0] === 'Bearer') {
-            token = req.headers.authorization.split(' ')[1];
-        }
-    } else {
-        token = req.headers[Users.tokenHeader()];
-    }
-    if (token) {
-        Users.tokens(token).then(function(admin) {
-            if (admin) {
-                self.success(admin,{scope:admin.permissions});
-            } else {
-                self.fail(401);
-            }
-        });
-    } else {
-        self.fail(401);
-    }
+    authenticateUserToken(req).then(user => {
+        this.success(user,{scope:user.permissions});
+    }).catch(err => {
+        this.fail(401);
+    });
 }
 
+
+
 module.exports = {
     bearerStrategy: bearerStrategy,
     clientPasswordStrategy: clientPasswordStrategy,
     passwordTokenExchange: passwordTokenExchange,
     anonymousStrategy: new AnonymousStrategy(),
-    tokensStrategy: new TokensStrategy()
+    tokensStrategy: new TokensStrategy(),
+    authenticateUserToken: authenticateUserToken
 }

packages/node_modules/@node-red/editor-api/lib/auth/users.js

@@ -61,7 +61,7 @@ var api = {
     authenticate: authenticate,
     default: getDefaultUser,
     tokens: getDefaultUser,
-    tokenHeader: "authorization"
+    tokenHeader: null
 }
 
 function init(config) {
@@ -111,6 +111,8 @@ function init(config) {
         api.tokens = config.tokens;
         if (config.tokenHeader && typeof config.tokenHeader === "string") {
             api.tokenHeader = config.tokenHeader.toLowerCase();
+        } else {
+            api.tokenHeader = "authorization";
         }
     }
 }

packages/node_modules/@node-red/editor-api/lib/editor/comms.js

@@ -21,6 +21,7 @@ var log = require("@node-red/util").log; // TODO: separate module
 var Tokens;
 var Users;
 var Permissions;
+var Strategies;
 
 var server;
 var settings;
@@ -44,6 +45,7 @@ function init(_server,_settings,_runtimeAPI) {
     Tokens.onSessionExpiry(handleSessionExpiry);
     Users = require("../auth/users");
     Permissions = require("../auth/permissions");
+    Strategies = require("../auth/strategies");
 
 }
 function handleSessionExpiry(session) {
@@ -63,17 +65,18 @@ function generateSession(length) {
     return token.join("");
 }
 
-function CommsConnection(ws) {
+function CommsConnection(ws, user) {
     this.session = generateSession(32);
     this.ws = ws;
     this.stack = [];
-    this.user = null;
+    this.user = user;
     this.lastSentTime = 0;
     var self = this;
 
     log.audit({event: "comms.open"});
     log.trace("comms.open "+self.session);
-    var pendingAuth = (settings.adminAuth != null);
+    var preAuthed = !!user;
+    var pendingAuth = !this.user && (settings.adminAuth != null);
 
     if (!pendingAuth) {
         addActiveConnection(self);
@@ -199,8 +202,8 @@ function start() {
             var commsPath = settings.httpAdminRoot || "/";
             commsPath = (commsPath.slice(0,1) != "/" ? "/":"") + commsPath + (commsPath.slice(-1) == "/" ? "":"/") + "comms";
             wsServer = new ws.Server({ noServer: true });
-            wsServer.on('connection',function(ws) {
-                var commsConnection = new CommsConnection(ws);
+            wsServer.on('connection',function(ws, request, user) {
+                var commsConnection = new CommsConnection(ws, user);
             });
             wsServer.on('error', function(err) {
                 log.warn(log._("comms.error-server",{message:err.toString()}));
@@ -209,8 +212,26 @@ function start() {
             server.on('upgrade', function upgrade(request, socket, head) {
                 const pathname = url.parse(request.url).pathname;
                 if (pathname === commsPath) {
+                    if (Users.tokenHeader() !== null && request.headers[Users.tokenHeader()]) {
+                        // The user has provided custom token handling. For the websocket,
+                        // the token could be provided in two ways:
+                        //  - as an http header (only possible with a reverse proxy setup)
+                        //  - passed over the connected websock in an auth packet
+                        // If the header is present, verify the token. If not, use the auth
+                        // packet over the connected socket
+                        //
+                        Strategies.authenticateUserToken(request).then(user => {
+                            wsServer.handleUpgrade(request, socket, head, function done(ws) {
+                                wsServer.emit('connection', ws, request, user);
+                            });
+                        }).catch(err => {
+                            log.audit({event: "comms.auth.fail"});
+                            socket.destroy();
+                        })
+                        return
+                    }
                     wsServer.handleUpgrade(request, socket, head, function done(ws) {
-                        wsServer.emit('connection', ws, request);
+                        wsServer.emit('connection', ws, request, null);
                     });
                 }
                 // Don't destroy the socket as other listeners may want to handle the

packages/node_modules/@node-red/editor-api/lib/editor/index.js

@@ -103,7 +103,7 @@ module.exports = {
             editorApp.get('/credentials/:type/:id', needsPermission("credentials.read"),credentials.get,apiUtil.errorHandler);
 
             // Settings
-            editorApp.get("/settings",needsPermission("settings.read"),info.runtimeSettings,apiUtil.errorHandler);
+            //  Main /settings route is an admin route - see lib/admin/settings.js
             // User Settings
             editorApp.get("/settings/user",needsPermission("settings.read"),info.userSettings,apiUtil.errorHandler);
             // User Settings

packages/node_modules/@node-red/editor-api/lib/editor/settings.js

@@ -16,56 +16,12 @@
 var apiUtils = require("../util");
 var runtimeAPI;
 var sshkeys = require("./sshkeys");
-var theme = require("./theme");
-var clone = require("clone");
-
-var i18n = require("@node-red/util").i18n
-
-function extend(target, source) {
-    var keys = Object.keys(source);
-    var i = keys.length;
-    while(i--) {
-        var value = source[keys[i]]
-        var type = typeof value;
-        if (type === 'string' || type === 'number' || type === 'boolean' || Array.isArray(value)) {
-            target[keys[i]] = value;
-        } else if (value === null) {
-            if (target.hasOwnProperty(keys[i])) {
-                delete target[keys[i]];
-            }
-        } else {
-            // Object
-            if (target.hasOwnProperty(keys[i])) {
-                target[keys[i]] = extend(target[keys[i]],value);
-            } else {
-                target[keys[i]] = value;
-            }
-        }
-    }
-    return target;
-}
 
 module.exports = {
     init: function(_runtimeAPI) {
         runtimeAPI = _runtimeAPI;
         sshkeys.init(runtimeAPI);
     },
-    runtimeSettings: function(req,res) {
-        var opts = {
-            user: req.user
-        }
-        runtimeAPI.settings.getRuntimeSettings(opts).then(function(result) {
-            result.editorTheme = result.editorTheme||{};
-            var themeSettings = theme.settings();
-            if (themeSettings) {
-                // result.editorTheme may already exist with the palette
-                // disabled. Need to merge that into the receive settings
-                result.editorTheme = extend(clone(themeSettings),result.editorTheme);
-            }
-            result.editorTheme.languages = i18n.availableLanguages("editor");
-            res.json(result);
-        });
-    },
     userSettings: function(req, res) {
         var opts = {
             user: req.user

packages/node_modules/@node-red/editor-api/lib/index.js

@@ -99,7 +99,7 @@ function init(settings,_server,storage,runtimeAPI) {
             adminApp.use(corsHandler);
         }
 
-        var adminApiApp = require("./admin").init(runtimeAPI);
+        var adminApiApp = require("./admin").init(settings, runtimeAPI);
         adminApp.use(adminApiApp);
     } else {
         adminApp = null;