Merge branch 'dev' into pr_1789

packages/node_modules/@node-red/editor-api/lib/admin/context.js

@@ -0,0 +1,41 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var apiUtils = require("../util");
+
+var runtimeAPI;
+
+
+module.exports = {
+    init: function(_runtimeAPI) {
+        runtimeAPI = _runtimeAPI;
+    },
+
+    get: function(req,res) {
+        var opts = {
+            user: req.user,
+            scope: req.params.scope,
+            id: req.params.id,
+            key: req.params[0],
+            store: req.query['store']
+        }
+        runtimeAPI.context.getValue(opts).then(function(result) {
+            res.json(result);
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        })
+    }
+}

packages/node_modules/@node-red/editor-api/lib/admin/flow.js

@@ -0,0 +1,69 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var runtimeAPI;
+var apiUtils = require("../util");
+
+module.exports = {
+    init: function(_runtimeAPI) {
+        runtimeAPI = _runtimeAPI;
+    },
+    get: function(req,res) {
+        var opts = {
+            user: req.user,
+            id: req.params.id
+        }
+        runtimeAPI.flows.getFlow(opts).then(function(result) {
+            return res.json(result);
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        })
+    },
+    post: function(req,res) {
+        var opts = {
+            user: req.user,
+            flow: req.body
+        }
+        runtimeAPI.flows.addFlow(opts).then(function(id) {
+            return res.json({id:id});
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        })
+    },
+    put: function(req,res) {
+        var opts = {
+            user: req.user,
+            id: req.params.id,
+            flow: req.body
+        }
+        runtimeAPI.flows.updateFlow(opts).then(function(id) {
+            return res.json({id:id});
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        })
+    },
+    delete: function(req,res) {
+        var opts = {
+            user: req.user,
+            id: req.params.id
+        }
+        runtimeAPI.flows.deleteFlow(opts).then(function() {
+            res.status(204).end();
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        })
+    }
+}

packages/node_modules/@node-red/editor-api/lib/admin/flows.js

@@ -0,0 +1,70 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var runtimeAPI;
+var apiUtils = require("../util");
+
+module.exports = {
+    init: function(_runtimeAPI) {
+        runtimeAPI = _runtimeAPI;
+    },
+    get: function(req,res) {
+        var version = req.get("Node-RED-API-Version")||"v1";
+        if (!/^v[12]$/.test(version)) {
+            return res.status(400).json({code:"invalid_api_version", message:"Invalid API Version requested"});
+        }
+        var opts = {
+            user: req.user
+        }
+        runtimeAPI.flows.getFlows(opts).then(function(result) {
+            if (version === "v1") {
+                res.json(result.flows);
+            } else if (version === "v2") {
+                res.json(result);
+            }
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        })
+    },
+    post: function(req,res) {
+        var version = req.get("Node-RED-API-Version")||"v1";
+        if (!/^v[12]$/.test(version)) {
+            return res.status(400).json({code:"invalid_api_version", message:"Invalid API Version requested"});
+        }
+        var opts = {
+            user: req.user,
+            deploymentType: req.get("Node-RED-Deployment-Type")||"full"
+        }
+
+        if (opts.deploymentType !== 'reload') {
+            if (version === "v1") {
+                opts.flows = {flows: req.body}
+            } else {
+                opts.flows = req.body;
+            }
+        }
+
+        runtimeAPI.flows.setFlows(opts).then(function(result) {
+            if (version === "v1") {
+                res.status(204).end();
+            } else {
+                res.json(result);
+            }
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        })
+    }
+}

packages/node_modules/@node-red/editor-api/lib/admin/index.js

@@ -0,0 +1,67 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var express = require("express");
+
+var nodes = require("./nodes");
+var flows = require("./flows");
+var flow = require("./flow");
+var context = require("./context");
+var auth = require("../auth");
+
+var apiUtil = require("../util");
+
+module.exports = {
+    init: function(runtimeAPI) {
+        flows.init(runtimeAPI);
+        flow.init(runtimeAPI);
+        nodes.init(runtimeAPI);
+        context.init(runtimeAPI);
+
+        var needsPermission = auth.needsPermission;
+
+        var adminApp = express();
+
+        // Flows
+        adminApp.get("/flows",needsPermission("flows.read"),flows.get,apiUtil.errorHandler);
+        adminApp.post("/flows",needsPermission("flows.write"),flows.post,apiUtil.errorHandler);
+
+        // Flow
+        adminApp.get("/flow/:id",needsPermission("flows.read"),flow.get,apiUtil.errorHandler);
+        adminApp.post("/flow",needsPermission("flows.write"),flow.post,apiUtil.errorHandler);
+        adminApp.delete("/flow/:id",needsPermission("flows.write"),flow.delete,apiUtil.errorHandler);
+        adminApp.put("/flow/:id",needsPermission("flows.write"),flow.put,apiUtil.errorHandler);
+
+        // Nodes
+        adminApp.get("/nodes",needsPermission("nodes.read"),nodes.getAll,apiUtil.errorHandler);
+        adminApp.post("/nodes",needsPermission("nodes.write"),nodes.post,apiUtil.errorHandler);
+        adminApp.get(/\/nodes\/messages/,needsPermission("nodes.read"),nodes.getModuleCatalogs,apiUtil.errorHandler);
+        adminApp.get(/\/nodes\/((@[^\/]+\/)?[^\/]+\/[^\/]+)\/messages/,needsPermission("nodes.read"),nodes.getModuleCatalog,apiUtil.errorHandler);
+        adminApp.get(/\/nodes\/((@[^\/]+\/)?[^\/]+)$/,needsPermission("nodes.read"),nodes.getModule,apiUtil.errorHandler);
+        adminApp.put(/\/nodes\/((@[^\/]+\/)?[^\/]+)$/,needsPermission("nodes.write"),nodes.putModule,apiUtil.errorHandler);
+        adminApp.delete(/\/nodes\/((@[^\/]+\/)?[^\/]+)$/,needsPermission("nodes.write"),nodes.delete,apiUtil.errorHandler);
+        adminApp.get(/\/nodes\/((@[^\/]+\/)?[^\/]+)\/([^\/]+)$/,needsPermission("nodes.read"),nodes.getSet,apiUtil.errorHandler);
+        adminApp.put(/\/nodes\/((@[^\/]+\/)?[^\/]+)\/([^\/]+)$/,needsPermission("nodes.write"),nodes.putSet,apiUtil.errorHandler);
+
+        // Context
+        adminApp.get("/context/:scope(global)",needsPermission("context.read"),context.get,apiUtil.errorHandler);
+        adminApp.get("/context/:scope(global)/*",needsPermission("context.read"),context.get,apiUtil.errorHandler);
+        adminApp.get("/context/:scope(node|flow)/:id",needsPermission("context.read"),context.get,apiUtil.errorHandler);
+        adminApp.get("/context/:scope(node|flow)/:id/*",needsPermission("context.read"),context.get,apiUtil.errorHandler);
+
+        return adminApp;
+    }
+}

packages/node_modules/@node-red/editor-api/lib/admin/nodes.js

@@ -0,0 +1,173 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var apiUtils = require("../util");
+
+var runtimeAPI;
+
+module.exports = {
+    init: function(_runtimeAPI) {
+        runtimeAPI = _runtimeAPI;
+    },
+    getAll: function(req,res) {
+        var opts = {
+            user: req.user
+        }
+        if (req.get("accept") == "application/json") {
+            runtimeAPI.nodes.getNodeList(opts).then(function(list) {
+                res.json(list);
+            })
+        } else {
+            opts.lang = apiUtils.determineLangFromHeaders(req.acceptsLanguages());
+            runtimeAPI.nodes.getNodeConfigs(opts).then(function(configs) {
+                res.send(configs);
+            })
+        }
+    },
+
+    post: function(req,res) {
+        var opts = {
+            user: req.user,
+            module: req.body.module,
+            version: req.body.version
+        }
+        runtimeAPI.nodes.addModule(opts).then(function(info) {
+            res.json(info);
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        })
+    },
+
+    delete: function(req,res) {
+        var opts = {
+            user: req.user,
+            module: req.params[0]
+        }
+        runtimeAPI.nodes.removeModule(opts).then(function() {
+            res.status(204).end();
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        })
+    },
+
+    getSet: function(req,res) {
+        var opts = {
+            user: req.user,
+            id: req.params[0] + "/" + req.params[2]
+        }
+        if (req.get("accept") === "application/json") {
+            runtimeAPI.nodes.getNodeInfo(opts).then(function(result) {
+                res.send(result);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        } else {
+            opts.lang = apiUtils.determineLangFromHeaders(req.acceptsLanguages());
+            runtimeAPI.nodes.getNodeConfig(opts).then(function(result) {
+                return res.send(result);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        }
+    },
+
+    getModule: function(req,res) {
+        var opts = {
+            user: req.user,
+            module: req.params[0]
+        }
+        runtimeAPI.nodes.getModuleInfo(opts).then(function(result) {
+            res.send(result);
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        })
+    },
+
+    putSet: function(req,res) {
+        var body = req.body;
+        if (!body.hasOwnProperty("enabled")) {
+            // log.audit({event: "nodes.module.set",error:"invalid_request"},req);
+            res.status(400).json({code:"invalid_request", message:"Invalid request"});
+            return;
+        }
+        var opts = {
+            user: req.user,
+            id: req.params[0] + "/" + req.params[2],
+            enabled: body.enabled
+        }
+        runtimeAPI.nodes.setNodeSetState(opts).then(function(result) {
+            res.send(result);
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        })
+    },
+
+    putModule: function(req,res) {
+        var body = req.body;
+        if (!body.hasOwnProperty("enabled")) {
+            // log.audit({event: "nodes.module.set",error:"invalid_request"},req);
+            res.status(400).json({code:"invalid_request", message:"Invalid request"});
+            return;
+        }
+        var opts = {
+            user: req.user,
+            module: req.params[0],
+            enabled: body.enabled
+        }
+        runtimeAPI.nodes.setModuleState(opts).then(function(result) {
+            res.send(result);
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        })
+
+    },
+
+    getModuleCatalog: function(req,res) {
+        var opts = {
+            user: req.user,
+            module: req.params[0],
+            lang: req.query.lng
+        }
+        runtimeAPI.nodes.getModuleCatalog(opts).then(function(result) {
+            res.json(result);
+        }).catch(function(err) {
+            console.log(err.stack);
+            apiUtils.rejectHandler(req,res,err);
+        })
+    },
+
+    getModuleCatalogs: function(req,res) {
+        var opts = {
+            user: req.user,
+            lang: req.query.lng
+        }
+        runtimeAPI.nodes.getModuleCatalogs(opts).then(function(result) {
+            res.json(result);
+        }).catch(function(err) {
+            console.log(err.stack);
+            apiUtils.rejectHandler(req,res,err);
+        })
+    },
+
+    getIcons: function(req,res) {
+        var opts = {
+            user: req.user
+        }
+        runtimeAPI.nodes.getIconList(opts).then(function(list) {
+            res.json(list);
+        });
+    }
+};

packages/node_modules/@node-red/editor-api/lib/auth/clients.js

@@ -0,0 +1,31 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var clients = [
+    {id:"node-red-editor",secret:"not_available"},
+    {id:"node-red-admin",secret:"not_available"}
+];
+
+module.exports = {
+    get: function(id) {
+        for (var i=0;i<clients.length;i++) {
+            if (clients[i].id == id) {
+                return Promise.resolve(clients[i]);
+            }
+        }
+        return Promise.resolve(null);
+    }
+}

packages/node_modules/@node-red/editor-api/lib/auth/index.js

@@ -0,0 +1,213 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var passport = require("passport");
+var oauth2orize = require("oauth2orize");
+
+var strategies = require("./strategies");
+var Tokens = require("./tokens");
+var Users = require("./users");
+var permissions = require("./permissions");
+
+var theme = require("../editor/theme");
+
+var settings = null;
+var log = require("@node-red/util").log; // TODO: separate module
+
+
+passport.use(strategies.bearerStrategy.BearerStrategy);
+passport.use(strategies.clientPasswordStrategy.ClientPasswordStrategy);
+passport.use(strategies.anonymousStrategy);
+
+var server = oauth2orize.createServer();
+
+server.exchange(oauth2orize.exchange.password(strategies.passwordTokenExchange));
+
+function init(_settings,storage) {
+    settings = _settings;
+    if (settings.adminAuth) {
+        var mergedAdminAuth = Object.assign({}, settings.adminAuth, settings.adminAuth.module);
+        Users.init(mergedAdminAuth);
+        Tokens.init(mergedAdminAuth,runtime.storage);
+    }
+}
+
+function needsPermission(permission) {
+    return function(req,res,next) {
+        if (settings && settings.adminAuth) {
+            return passport.authenticate(['bearer','anon'],{ session: false })(req,res,function() {
+                if (!req.user) {
+                    return next();
+                }
+                if (permissions.hasPermission(req.authInfo.scope,permission)) {
+                    return next();
+                }
+                log.audit({event: "permission.fail", permissions: permission},req);
+                return res.status(401).end();
+            });
+        } else {
+            next();
+        }
+    }
+}
+
+function ensureClientSecret(req,res,next) {
+    if (!req.body.client_secret) {
+        req.body.client_secret = 'not_available';
+    }
+    next();
+}
+function authenticateClient(req,res,next) {
+    return passport.authenticate(['oauth2-client-password'], {session: false})(req,res,next);
+}
+function getToken(req,res,next) {
+    return server.token()(req,res,next);
+}
+
+function login(req,res) {
+    var response = {};
+    if (settings.adminAuth) {
+        var mergedAdminAuth = Object.assign({}, settings.adminAuth, settings.adminAuth.module);
+        if (mergedAdminAuth.type === "credentials") {
+            response = {
+                "type":"credentials",
+                "prompts":[{id:"username",type:"text",label:"user.username"},{id:"password",type:"password",label:"user.password"}]
+            }
+        } else if (mergedAdminAuth.type === "strategy") {
+
+            var urlPrefix = (settings.httpAdminRoot==='/')?"":settings.httpAdminRoot;
+            response = {
+                "type":"strategy",
+                "prompts":[{type:"button",label:mergedAdminAuth.strategy.label, url: urlPrefix + "auth/strategy"}]
+            }
+            if (mergedAdminAuth.strategy.icon) {
+                response.prompts[0].icon = mergedAdminAuth.strategy.icon;
+            }
+            if (mergedAdminAuth.strategy.image) {
+                response.prompts[0].image = theme.serveFile('/login/',mergedAdminAuth.strategy.image);
+            }
+        }
+        if (theme.context().login && theme.context().login.image) {
+            response.image = theme.context().login.image;
+        }
+    }
+    res.json(response);
+}
+
+function revoke(req,res) {
+    var token = req.body.token;
+    // TODO: audit log
+    Tokens.revoke(token).then(function() {
+        log.audit({event: "auth.login.revoke"},req);
+        if (settings.editorTheme && settings.editorTheme.logout && settings.editorTheme.logout.redirect) {
+            res.json({redirect:settings.editorTheme.logout.redirect});
+        } else {
+            res.status(200).end();
+        }
+    });
+}
+
+function completeVerify(profile,done) {
+    Users.authenticate(profile).then(function(user) {
+        if (user) {
+            Tokens.create(user.username,"node-red-editor",user.permissions).then(function(tokens) {
+                log.audit({event: "auth.login",username:user.username,scope:user.permissions});
+                user.tokens = tokens;
+                done(null,user);
+            });
+        } else {
+            log.audit({event: "auth.login.fail.oauth",username:typeof profile === "string"?profile:profile.username});
+            done(null,false);
+        }
+    });
+}
+
+
+function genericStrategy(adminApp,strategy) {
+    var crypto = require("crypto")
+    var session = require('express-session')
+    var MemoryStore = require('memorystore')(session)
+
+    adminApp.use(session({
+      // As the session is only used across the life-span of an auth
+      // hand-shake, we can use a instance specific random string
+      secret: crypto.randomBytes(20).toString('hex'),
+      resave: false,
+      saveUninitialized: false,
+      store: new MemoryStore({
+        checkPeriod: 86400000 // prune expired entries every 24h
+      })
+    }));
+    //TODO: all passport references ought to be in ./auth
+    adminApp.use(passport.initialize());
+    adminApp.use(passport.session());
+
+    var options = strategy.options;
+
+    passport.use(new strategy.strategy(options,
+        function() {
+            var originalDone = arguments[arguments.length-1];
+            if (options.verify) {
+                var args = Array.from(arguments);
+                args[args.length-1] = function(err,profile) {
+                    if (err) {
+                        return originalDone(err);
+                    } else {
+                        return completeVerify(profile,originalDone);
+                    }
+                };
+                options.verify.apply(null,args);
+            } else {
+                var profile = arguments[arguments.length - 2];
+                return completeVerify(profile,originalDone);
+            }
+
+        }
+    ));
+
+    adminApp.get('/auth/strategy',
+        passport.authenticate(strategy.name, {session:false, failureRedirect: settings.httpAdminRoot }),
+        completeGenerateStrategyAuth
+    );
+    adminApp.get('/auth/strategy/callback',
+        passport.authenticate(strategy.name, {session:false, failureRedirect: settings.httpAdminRoot }),
+        completeGenerateStrategyAuth
+    );
+
+}
+function completeGenerateStrategyAuth(req,res) {
+    var tokens = req.user.tokens;
+    delete req.user.tokens;
+    // Successful authentication, redirect home.
+    res.redirect(settings.httpAdminRoot + '?access_token='+tokens.accessToken);
+}
+
+module.exports = {
+    init: init,
+    needsPermission: needsPermission,
+    ensureClientSecret: ensureClientSecret,
+    authenticateClient: authenticateClient,
+    getToken: getToken,
+    errorHandler: function(err,req,res,next) {
+        //TODO: audit log statment
+        //console.log(err.stack);
+        //log.log({level:"audit",type:"auth",msg:err.toString()});
+        return server.errorHandler()(err,req,res,next);
+    },
+    login: login,
+    revoke: revoke,
+    genericStrategy: genericStrategy
+}

packages/node_modules/@node-red/editor-api/lib/auth/permissions.js

@@ -0,0 +1,65 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var util = require('util');
+
+var readRE = /^((.+)\.)?read$/
+var writeRE = /^((.+)\.)?write$/
+
+function hasPermission(userScope,permission) {
+    if (permission === "") {
+        return true;
+    }
+    var i;
+
+    if (util.isArray(permission)) {
+        // Multiple permissions requested - check each one
+        for (i=0;i<permission.length;i++) {
+            if (!hasPermission(userScope,permission[i])) {
+                return false;
+            }
+        }
+        // All permissions check out
+        return true;
+    }
+
+    if (util.isArray(userScope)) {
+        if (userScope.length === 0) {
+            return false;
+        }
+        for (i=0;i<userScope.length;i++) {
+            if (hasPermission(userScope[i],permission)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    if (userScope === "*" || userScope === permission) {
+        return true;
+    }
+
+    if (userScope === "read" || userScope === "*.read") {
+        return readRE.test(permission);
+    } else if (userScope === "write" || userScope === "*.write") {
+        return writeRE.test(permission);
+    }
+    return false;
+}
+
+module.exports = {
+    hasPermission: hasPermission,
+}

packages/node_modules/@node-red/editor-api/lib/auth/strategies.js

@@ -0,0 +1,131 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var BearerStrategy = require('passport-http-bearer').Strategy;
+var ClientPasswordStrategy = require('passport-oauth2-client-password').Strategy;
+
+var passport = require("passport");
+var crypto = require("crypto");
+var util = require("util");
+
+var Tokens = require("./tokens");
+var Users = require("./users");
+var Clients = require("./clients");
+var permissions = require("./permissions");
+
+var log = require("@node-red/util").log; // TODO: separate module
+
+var bearerStrategy = function (accessToken, done) {
+    // is this a valid token?
+    Tokens.get(accessToken).then(function(token) {
+        if (token) {
+            Users.get(token.user).then(function(user) {
+                if (user) {
+                    done(null,user,{scope:token.scope});
+                } else {
+                    log.audit({event: "auth.invalid-token"});
+                    done(null,false);
+                }
+            });
+        } else {
+            log.audit({event: "auth.invalid-token"});
+            done(null,false);
+        }
+    });
+}
+bearerStrategy.BearerStrategy = new BearerStrategy(bearerStrategy);
+
+var clientPasswordStrategy = function(clientId, clientSecret, done) {
+    Clients.get(clientId).then(function(client) {
+        if (client && client.secret == clientSecret) {
+            done(null,client);
+        } else {
+            log.audit({event: "auth.invalid-client",client:clientId});
+            done(null,false);
+        }
+    });
+}
+clientPasswordStrategy.ClientPasswordStrategy = new ClientPasswordStrategy(clientPasswordStrategy);
+
+var loginAttempts = [];
+var loginSignInWindow = 600000; // 10 minutes
+
+
+var passwordTokenExchange = function(client, username, password, scope, done) {
+    var now = Date.now();
+    loginAttempts = loginAttempts.filter(function(logEntry) {
+        return logEntry.time + loginSignInWindow > now;
+    });
+    loginAttempts.push({time:now, user:username});
+    var attemptCount = 0;
+    loginAttempts.forEach(function(logEntry) {
+        /* istanbul ignore else */
+        if (logEntry.user == username) {
+            attemptCount++;
+        }
+    });
+    if (attemptCount > 5) {
+        log.audit({event: "auth.login.fail.too-many-attempts",username:username,client:client.id});
+        done(new Error("Too many login attempts. Wait 10 minutes and try again"),false);
+        return;
+    }
+
+    Users.authenticate(username,password).then(function(user) {
+        if (user) {
+            if (scope === "") {
+                scope = user.permissions;
+            }
+            if (permissions.hasPermission(user.permissions,scope)) {
+                loginAttempts = loginAttempts.filter(function(logEntry) {
+                    return logEntry.user !== username;
+                });
+                Tokens.create(username,client.id,scope).then(function(tokens) {
+                    log.audit({event: "auth.login",username:username,client:client.id,scope:scope});
+                    done(null,tokens.accessToken,null,{expires_in:tokens.expires_in});
+                });
+            } else {
+                log.audit({event: "auth.login.fail.permissions",username:username,client:client.id,scope:scope});
+                done(null,false);
+            }
+        } else {
+            log.audit({event: "auth.login.fail.credentials",username:username,client:client.id,scope:scope});
+            done(null,false);
+        }
+    });
+}
+
+function AnonymousStrategy() {
+  passport.Strategy.call(this);
+  this.name = 'anon';
+}
+util.inherits(AnonymousStrategy, passport.Strategy);
+AnonymousStrategy.prototype.authenticate = function(req) {
+    var self = this;
+    Users.default().then(function(anon) {
+        if (anon) {
+            self.success(anon,{scope:anon.permissions});
+        } else {
+            self.fail(401);
+        }
+    });
+}
+
+module.exports = {
+    bearerStrategy: bearerStrategy,
+    clientPasswordStrategy: clientPasswordStrategy,
+    passwordTokenExchange: passwordTokenExchange,
+    anonymousStrategy: new AnonymousStrategy()
+}

packages/node_modules/@node-red/editor-api/lib/auth/tokens.js

@@ -0,0 +1,129 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+function generateToken(length) {
+    var c = "ABCDEFGHIJKLMNOPQRSTUZWXYZabcdefghijklmnopqrstuvwxyz1234567890";
+    var token = [];
+    for (var i=0;i<length;i++) {
+        token.push(c[Math.floor(Math.random()*c.length)]);
+    }
+    return token.join("");
+}
+
+
+var storage;
+
+var sessionExpiryTime
+
+var sessions = {};
+
+var loadedSessions = null;
+
+var apiAccessTokens;
+
+function expireSessions() {
+    var now = Date.now();
+    var modified = false;
+    for (var t in sessions) {
+        if (sessions.hasOwnProperty(t)) {
+            var session = sessions[t];
+            if (!session.hasOwnProperty("expires") || session.expires < now) {
+                delete sessions[t];
+                modified = true;
+            }
+        }
+    }
+    if (modified) {
+        return storage.saveSessions(sessions);
+    } else {
+        return Promise.resolve();
+    }
+}
+function loadSessions() {
+    if (loadedSessions === null) {
+        loadedSessions = storage.getSessions().then(function(_sessions) {
+             sessions = _sessions||{};
+             return expireSessions();
+        });
+    }
+    return loadedSessions;
+}
+
+module.exports = {
+    init: function(adminAuthSettings, _storage) {
+        storage = _storage;
+        sessionExpiryTime = adminAuthSettings.sessionExpiryTime || 604800; // 1 week in seconds
+        // At this point, storage will not have been initialised, so defer loading
+        // the sessions until there's a request for them.
+        loadedSessions = null;
+
+        apiAccessTokens = {};
+        if ( Array.isArray(adminAuthSettings.tokens) ) {
+            apiAccessTokens = adminAuthSettings.tokens.reduce(function(prev, current) {
+                prev[current.token] = {
+                    user: current.user,
+                    scope: current.scope
+                };
+                return prev;
+            }, {});
+        }
+        return Promise.resolve();
+    },
+    get: function(token) {
+        return loadSessions().then(function() {
+            var info = apiAccessTokens[token] || null;
+
+            if (info) {
+                return Promise.resolve(info);
+            } else {
+                if (sessions[token]) {
+                    if (sessions[token].expires < Date.now()) {
+                        return expireSessions().then(function() { return null });
+                    }
+                }
+                return Promise.resolve(sessions[token]);
+            }
+        });
+    },
+    create: function(user,client,scope) {
+        return loadSessions().then(function() {
+            var accessToken = generateToken(128);
+
+            var accessTokenExpiresAt = Date.now() + (sessionExpiryTime*1000);
+
+            var session = {
+                user:user,
+                client:client,
+                scope:scope,
+                accessToken: accessToken,
+                expires: accessTokenExpiresAt
+            };
+            sessions[accessToken] = session;
+            return storage.saveSessions(sessions).then(function() {
+                return {
+                    accessToken: accessToken,
+                    expires_in: sessionExpiryTime
+                }
+            });
+        });
+    },
+    revoke: function(token) {
+        return loadSessions().then(function() {
+            delete sessions[token];
+            return storage.saveSessions(sessions);
+        });
+    }
+}

packages/node_modules/@node-red/editor-api/lib/auth/users.js

@@ -0,0 +1,122 @@
+/**
+* Copyright JS Foundation and other contributors, http://js.foundation
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+* http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+**/
+
+var util = require("util");
+var clone = require("clone");
+var bcrypt;
+try { bcrypt = require('bcrypt'); }
+catch(e) { bcrypt = require('bcryptjs'); }
+var users = {};
+var defaultUser = null;
+
+function authenticate() {
+    var username = arguments[0];
+    if (typeof username !== 'string') {
+        username = username.username;
+    }
+    const args = Array.from(arguments);
+    return api.get(username).then(function(user) {
+        if (user) {
+            if (args.length === 2) {
+                // Username/password authentication
+                var password = args[1];
+                return new Promise(function(resolve,reject) {
+                    bcrypt.compare(password, user.password, function(err, res) {
+                        resolve(res?cleanUser(user):null);
+                    });
+                });
+            } else {
+                // Try to extract common profile information
+                if (args[0].hasOwnProperty('photos') && args[0].photos.length > 0) {
+                    user.image = args[0].photos[0].value;
+                }
+                return cleanUser(user);
+            }
+        }
+        return null;
+    });
+}
+function get(username) {
+    return Promise.resolve(users[username]);
+}
+function getDefaultUser() {
+    return Promise.resolve(null);
+}
+
+var api = {
+    get: get,
+    authenticate: authenticate,
+    default: getDefaultUser
+}
+
+function init(config) {
+    users = {};
+    defaultUser = null;
+    if (config.type == "credentials" || config.type == "strategy") {
+        if (config.users) {
+            if (typeof config.users === "function") {
+                api.get = config.users;
+            } else {
+                var us = config.users;
+                /* istanbul ignore else */
+                if (!util.isArray(us)) {
+                    us = [us];
+                }
+                for (var i=0;i<us.length;i++) {
+                    var u = us[i];
+                    users[u.username] = clone(u);
+                }
+            }
+        }
+        if (config.authenticate && typeof config.authenticate === "function") {
+            api.authenticate = config.authenticate;
+        } else {
+            api.authenticate = authenticate;
+        }
+    } else {
+        api.get = get;
+        api.authenticate = authenticate;
+        api.default = api.default;
+    }
+    if (config.default) {
+        if (typeof config.default === "function") {
+            api.default = config.default;
+        } else {
+            api.default = function() {
+                return Promise.resolve({
+                    "anonymous": true,
+                    "permissions":config.default.permissions
+                });
+            }
+        }
+    } else {
+        api.default = getDefaultUser;
+    }
+}
+function cleanUser(user) {
+    if (user && user.hasOwnProperty('password')) {
+        user = clone(user);
+        delete user.password;
+    }
+    return user;
+}
+
+module.exports = {
+    init: init,
+    get: function(username) { return api.get(username).then(cleanUser)},
+    authenticate: function() { return api.authenticate.apply(null, arguments) },
+    default: function() { return api.default(); }
+};

packages/node_modules/@node-red/editor-api/lib/editor/comms.js

@@ -0,0 +1,243 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var ws = require("ws");
+
+var log = require("@node-red/util").log; // TODO: separate module
+var Tokens;
+var Users;
+var Permissions;
+
+var server;
+var settings;
+var runtimeAPI;
+
+var wsServer;
+var activeConnections = [];
+
+var anonymousUser;
+
+var retained = {};
+
+var heartbeatTimer;
+var lastSentTime;
+
+function init(_server,_settings,_runtimeAPI) {
+    server = _server;
+    settings = _settings;
+    runtimeAPI = _runtimeAPI;
+    Tokens = require("../auth/tokens");
+    Users = require("../auth/users");
+    Permissions = require("../auth/permissions");
+
+}
+
+function generateSession(length) {
+    var c = "ABCDEFGHIJKLMNOPQRSTUZWXYZabcdefghijklmnopqrstuvwxyz1234567890";
+    var token = [];
+    for (var i=0;i<length;i++) {
+        token.push(c[Math.floor(Math.random()*c.length)]);
+    }
+    return token.join("");
+}
+
+function CommsConnection(ws) {
+    this.session = generateSession(32);
+    this.ws = ws;
+    this.stack = [];
+    this.user = null;
+    this.lastSentTime = 0;
+    var self = this;
+
+    log.audit({event: "comms.open"});
+    log.trace("comms.open "+self.session);
+    var pendingAuth = (settings.adminAuth != null);
+
+    if (!pendingAuth) {
+        addActiveConnection(self);
+    }
+    ws.on('close',function() {
+        log.audit({event: "comms.close",user:self.user, session: self.session});
+        log.trace("comms.close "+self.session);
+        removeActiveConnection(self);
+    });
+    ws.on('message', function(data,flags) {
+        var msg = null;
+        try {
+            msg = JSON.parse(data);
+        } catch(err) {
+            log.trace("comms received malformed message : "+err.toString());
+            return;
+        }
+        if (!pendingAuth) {
+            if (msg.subscribe) {
+                self.subscribe(msg.subscribe);
+                // handleRemoteSubscription(ws,msg.subscribe);
+            }
+        } else {
+            var completeConnection = function(userScope,sendAck) {
+                try {
+                    if (!userScope || !Permissions.hasPermission(userScope,"status.read")) {
+                        ws.send(JSON.stringify({auth:"fail"}));
+                        ws.close();
+                    } else {
+                        pendingAuth = false;
+                        addActiveConnection(self);
+                        if (sendAck) {
+                            ws.send(JSON.stringify({auth:"ok"}));
+                        }
+                    }
+                } catch(err) {
+                    console.log(err.stack);
+                    // Just in case the socket closes before we attempt
+                    // to send anything.
+                }
+            }
+            if (msg.auth) {
+                Tokens.get(msg.auth).then(function(client) {
+                    if (client) {
+                        Users.get(client.user).then(function(user) {
+                            if (user) {
+                                self.user = user;
+                                log.audit({event: "comms.auth",user:self.user});
+                                completeConnection(client.scope,true);
+                            } else {
+                                log.audit({event: "comms.auth.fail"});
+                                completeConnection(null,false);
+                            }
+                        });
+                    } else {
+                        log.audit({event: "comms.auth.fail"});
+                        completeConnection(null,false);
+                    }
+                });
+            } else {
+                if (anonymousUser) {
+                    log.audit({event: "comms.auth",user:anonymousUser});
+                    self.user = anonymousUser;
+                    completeConnection(anonymousUser.permissions,false);
+                    //TODO: duplicated code - pull non-auth message handling out
+                    if (msg.subscribe) {
+                        self.subscribe(msg.subscribe);
+                    }
+                } else {
+                    log.audit({event: "comms.auth.fail"});
+                    completeConnection(null,false);
+                }
+            }
+        }
+    });
+    ws.on('error', function(err) {
+        log.warn(log._("comms.error",{message:err.toString()}));
+    });
+}
+
+CommsConnection.prototype.send = function(topic,data) {
+    var self = this;
+    if (topic && data) {
+        this.stack.push({topic:topic,data:data});
+    }
+    if (!this._xmitTimer) {
+        this._xmitTimer = setTimeout(function() {
+            try {
+                self.ws.send(JSON.stringify(self.stack));
+                self.lastSentTime = Date.now();
+            } catch(err) {
+                removeActiveConnection(self);
+                log.warn(log._("comms.error-send",{message:err.toString()}));
+            }
+            delete self._xmitTimer;
+            self.stack = [];
+        },50);
+    }
+}
+
+CommsConnection.prototype.subscribe = function(topic) {
+    runtimeAPI.comms.subscribe({
+        user: this.user,
+        client: this,
+        topic: topic
+    })
+}
+
+function start() {
+    if (!settings.disableEditor) {
+        Users.default().then(function(_anonymousUser) {
+            anonymousUser = _anonymousUser;
+            var webSocketKeepAliveTime = settings.webSocketKeepAliveTime || 15000;
+            var path = settings.httpAdminRoot || "/";
+            path = (path.slice(0,1) != "/" ? "/":"") + path + (path.slice(-1) == "/" ? "":"/") + "comms";
+            wsServer = new ws.Server({
+                server:server,
+                path:path,
+                // Disable the deflate option due to this issue
+                //  https://github.com/websockets/ws/pull/632
+                // that is fixed in the 1.x release of the ws module
+                // that we cannot currently pickup as it drops node 0.10 support
+                //perMessageDeflate: false
+            });
+
+            wsServer.on('connection',function(ws) {
+                var commsConnection = new CommsConnection(ws);
+            });
+
+
+            wsServer.on('error', function(err) {
+                log.warn(log._("comms.error-server",{message:err.toString()}));
+            });
+
+            lastSentTime = Date.now();
+
+            heartbeatTimer = setInterval(function() {
+                var now = Date.now();
+                if (now-lastSentTime > webSocketKeepAliveTime) {
+                    activeConnections.forEach(connection => connection.send("hb",lastSentTime));
+                }
+            }, webSocketKeepAliveTime);
+        });
+    }
+}
+
+function stop() {
+    if (heartbeatTimer) {
+        clearInterval(heartbeatTimer);
+        heartbeatTimer = null;
+    }
+    if (wsServer) {
+        wsServer.close();
+        wsServer = null;
+    }
+}
+
+function addActiveConnection(connection) {
+    activeConnections.push(connection);
+    runtimeAPI.comms.addConnection({client: connection});
+}
+function removeActiveConnection(connection) {
+    for (var i=0;i<activeConnections.length;i++) {
+        if (activeConnections[i] === connection) {
+            activeConnections.splice(i,1);
+            runtimeAPI.comms.removeConnection({client:connection})
+            break;
+        }
+    }
+}
+
+module.exports = {
+    init:init,
+    start:start,
+    stop:stop
+}

packages/node_modules/@node-red/editor-api/lib/editor/credentials.js

@@ -0,0 +1,36 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var runtimeAPI;
+var apiUtils = require("../util");
+
+module.exports = {
+    init: function(_runtimeAPI) {
+        runtimeAPI = _runtimeAPI
+    },
+    get: function (req, res) {
+        var opts = {
+            user: req.user,
+            type: req.params.type,
+            id: req.params.id
+        }
+        runtimeAPI.flows.getNodeCredentials(opts).then(function(result) {
+            res.json(result);
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        })
+    }
+}

packages/node_modules/@node-red/editor-api/lib/editor/index.js

@@ -0,0 +1,124 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var express = require("express");
+var path = require('path');
+
+var comms = require("./comms");
+var library = require("./library");
+var info = require("./settings");
+
+var auth = require("../auth");
+var nodes = require("../admin/nodes"); // TODO: move /icons into here
+var needsPermission;
+var runtimeAPI;
+var log = require("@node-red/util").log; // TODO: separate module
+var i18n = require("@node-red/util").i18n; // TODO: separate module
+
+var apiUtil = require("../util");
+
+var ensureRuntimeStarted = function(req,res,next) {
+    runtimeAPI.isStarted().then( started => {
+        if (!started) {
+            log.error("Node-RED runtime not started");
+            res.status(503).send("Not started");
+        } else {
+            next()
+        }
+    })
+}
+
+module.exports = {
+    init: function(server, settings, _runtimeAPI) {
+        runtimeAPI = _runtimeAPI;
+        needsPermission = auth.needsPermission;
+        if (!settings.disableEditor) {
+            info.init(runtimeAPI);
+            comms.init(server,settings,runtimeAPI);
+
+            var ui = require("./ui");
+
+            ui.init(runtimeAPI);
+
+            var editorApp = express();
+            if (settings.requireHttps === true) {
+                editorApp.enable('trust proxy');
+                editorApp.use(function (req, res, next) {
+                    if (req.secure) {
+                        next();
+                    } else {
+                        res.redirect('https://' + req.headers.host + req.originalUrl);
+                    }
+                });
+            }
+            editorApp.get("/",ensureRuntimeStarted,ui.ensureSlash,ui.editor);
+
+            editorApp.get("/icons",needsPermission("nodes.read"),nodes.getIcons,apiUtil.errorHandler);
+            editorApp.get("/icons/:module/:icon",ui.icon);
+            editorApp.get("/icons/:scope/:module/:icon",ui.icon);
+
+            var theme = require("./theme");
+            theme.init(settings);
+            editorApp.use("/theme",theme.app());
+            editorApp.use("/",ui.editorResources);
+
+            //Projects
+            var projects = require("./projects");
+            projects.init(runtimeAPI);
+            editorApp.use("/projects",projects.app());
+
+            // Locales
+            var locales = require("./locales");
+            locales.init(runtimeAPI);
+            editorApp.get(/locales\/(.+)\/?$/,locales.get,apiUtil.errorHandler);
+
+            // Library
+            var library = require("./library");
+            library.init(runtimeAPI);
+            editorApp.get("/library/flows",needsPermission("library.read"),library.getAll,apiUtil.errorHandler);
+            editorApp.get(/library\/([^\/]+)(?:$|\/(.*))/,needsPermission("library.read"),library.getEntry);
+            editorApp.post(/library\/([^\/]+)\/(.*)/,needsPermission("library.write"),library.saveEntry);
+
+
+            // Credentials
+            var credentials = require("./credentials");
+            credentials.init(runtimeAPI);
+            editorApp.get('/credentials/:type/:id', needsPermission("credentials.read"),credentials.get,apiUtil.errorHandler);
+
+            // Settings
+            editorApp.get("/settings",needsPermission("settings.read"),info.runtimeSettings,apiUtil.errorHandler);
+            // User Settings
+            editorApp.get("/settings/user",needsPermission("settings.read"),info.userSettings,apiUtil.errorHandler);
+            // User Settings
+            editorApp.post("/settings/user",needsPermission("settings.write"),info.updateUserSettings,apiUtil.errorHandler);
+            // SSH keys
+            editorApp.use("/settings/user/keys",needsPermission("settings.write"),info.sshkeys());
+
+            return editorApp;
+        }
+    },
+    start: function() {
+        var catalogPath = path.resolve(path.join(path.dirname(require.resolve("@node-red/editor-client")),"locales"));
+        return i18n.registerMessageCatalogs([
+            {namespace: "editor",   dir: catalogPath, file:"editor.json"},
+            {namespace: "jsonata",  dir: catalogPath, file:"jsonata.json"},
+            {namespace: "infotips", dir: catalogPath, file:"infotips.json"}
+        ]).then(function(){
+            comms.start();
+        });
+    },
+    stop: comms.stop
+}

packages/node_modules/@node-red/editor-api/lib/editor/library.js

@@ -0,0 +1,83 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var apiUtils = require("../util");
+var fs = require('fs');
+var fspath = require('path');
+var when = require('when');
+
+var runtimeAPI;
+
+module.exports = {
+    init: function(_runtimeAPI) {
+        runtimeAPI = _runtimeAPI;
+    },
+
+    getAll: function(req,res) {
+        var opts = {
+            user: req.user,
+            type: 'flows'
+        }
+        runtimeAPI.library.getEntries(opts).then(function(result) {
+            res.json(result);
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        });
+    },
+    getEntry: function(req,res) {
+        var opts = {
+            user: req.user,
+            type: req.params[0],
+            path: req.params[1]||""
+        }
+        runtimeAPI.library.getEntry(opts).then(function(result) {
+            if (typeof result === "string") {
+                if (opts.type === 'flows') {
+                    res.writeHead(200, {'Content-Type': 'application/json'});
+                } else {
+                    res.writeHead(200, {'Content-Type': 'text/plain'});
+                }
+                res.write(result);
+                res.end();
+            } else {
+                res.json(result);
+            }
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        });
+    },
+    saveEntry: function(req,res) {
+        var opts = {
+            user: req.user,
+            type: req.params[0],
+            path: req.params[1]||""
+        }
+        // TODO: horrible inconsistencies between flows and all other types
+        if (opts.type === "flows") {
+            opts.meta = {};
+            opts.body = JSON.stringify(req.body);
+        } else {
+            opts.meta = req.body;
+            opts.body = opts.meta.text;
+            delete opts.meta.text;
+        }
+        runtimeAPI.library.saveEntry(opts).then(function(result) {
+            res.status(204).end();
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        });
+    }
+}

packages/node_modules/@node-red/editor-api/lib/editor/locales.js

@@ -0,0 +1,53 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+var fs = require('fs');
+var path = require('path');
+//var apiUtil = require('../util');
+
+var i18n = require("@node-red/util").i18n; // TODO: separate module
+
+var runtimeAPI;
+
+function loadResource(lang, namespace) {
+    var catalog = i18n.i.getResourceBundle(lang, namespace);
+    if (!catalog) {
+        var parts = lang.split("-");
+        if (parts.length == 2) {
+            var new_lang = parts[0];
+            return i18n.i.getResourceBundle(new_lang, namespace);
+        }
+    }
+    return catalog;
+}
+
+module.exports = {
+    init: function(_runtimeAPI) {
+        runtimeAPI = _runtimeAPI;
+    },
+    get: function(req,res) {
+        var namespace = req.params[0];
+        var lngs = req.query.lng;
+        namespace = namespace.replace(/\.json$/,"");
+        var lang = req.query.lng; //apiUtil.determineLangFromHeaders(req.acceptsLanguages() || []);
+        var prevLang = i18n.i.language;
+        // Trigger a load from disk of the language if it is not the default
+        i18n.i.changeLanguage(lang, function(){
+            var catalog = loadResource(lang, namespace);
+            res.json(catalog||{});
+        });
+        i18n.i.changeLanguage(prevLang);
+    }
+}

packages/node_modules/@node-red/editor-api/lib/editor/projects.js

@@ -0,0 +1,511 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var express = require("express");
+var apiUtils = require("../util");
+
+var runtimeAPI;
+var needsPermission = require("../auth").needsPermission;
+
+function listProjects(req,res) {
+    var opts = {
+        user: req.user
+    }
+    runtimeAPI.projects.listProjects(opts).then(function(result) {
+        res.json(result);
+    }).catch(function(err) {
+        apiUtils.rejectHandler(req,res,err);
+    });
+}
+function getProject(req,res) {
+    var opts = {
+        user: req.user,
+        id: req.params.id
+    }
+    runtimeAPI.projects.getProject(opts).then(function(data) {
+        if (data) {
+            res.json(data);
+        } else {
+            res.status(404).end();
+        }
+    }).catch(function(err) {
+        apiUtils.rejectHandler(req,res,err);
+    })
+}
+function getProjectStatus(req,res) {
+    var opts = {
+        user: req.user,
+        id: req.params.id,
+        remote: req.query.remote
+    }
+    runtimeAPI.projects.getStatus(opts).then(function(data){
+        if (data) {
+            res.json(data);
+        } else {
+            res.status(404).end();
+        }
+    }).catch(function(err) {
+        apiUtils.rejectHandler(req,res,err);
+    })
+}
+function getProjectRemotes(req,res) {
+    var opts = {
+        user: req.user,
+        id: req.params.id
+    }
+    runtimeAPI.projects.getRemotes(opts).then(function(data) {
+        res.json(data);
+    }).catch(function(err) {
+        apiUtils.rejectHandler(req,res,err);
+    })
+}
+module.exports = {
+    init: function(_runtimeAPI) {
+        runtimeAPI = _runtimeAPI;
+    },
+    app: function() {
+        var app = express();
+
+        app.use(function(req,res,next) {
+            runtimeAPI.projects.available().then(function(available) {
+                if (!available) {
+                    res.status(404).end();
+                } else {
+                    next();
+                }
+            })
+        });
+
+        // Projects
+
+        // List all projects
+        app.get("/", needsPermission("projects.read"),listProjects);
+
+        // Create project
+        app.post("/", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                project: req.body
+            }
+            runtimeAPI.projects.createProject(opts).then(function(result) {
+                res.json(result);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            });
+        });
+
+        // Update a project
+        app.put("/:id", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                project: req.body
+            }
+
+            if (req.body.active) {
+                runtimeAPI.projects.setActiveProject(opts).then(function() {
+                    listProjects(req,res);
+                }).catch(function(err) {
+                    apiUtils.rejectHandler(req,res,err);
+                })
+            } else if (req.body.initialise) {
+                runtimeAPI.projects.initialiseProject(opts).then(function() {
+                    getProject(req,res);
+                }).catch(function(err) {
+                    apiUtils.rejectHandler(req,res,err);
+                })
+            } else if (req.body.hasOwnProperty('credentialSecret') ||
+                       req.body.hasOwnProperty('description') ||
+                       req.body.hasOwnProperty('dependencies')||
+                       req.body.hasOwnProperty('summary') ||
+                       req.body.hasOwnProperty('files') ||
+                        req.body.hasOwnProperty('git')) {
+                runtimeAPI.projects.updateProject(opts).then(function() {
+                    getProject(req,res);
+                }).catch(function(err) {
+                    apiUtils.rejectHandler(req,res,err);
+                })
+            } else {
+                res.status(400).json({error:"unexpected_error", message:"invalid_request"});
+            }
+        });
+
+        // Get project metadata
+        app.get("/:id", needsPermission("projects.read"), getProject);
+
+        // Delete project
+        app.delete("/:id", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id
+            }
+            runtimeAPI.projects.deleteProject(opts).then(function() {
+                res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+
+        // Get project status - files, commit counts, branch info
+        app.get("/:id/status", needsPermission("projects.read"), getProjectStatus);
+
+
+        // Project file listing
+        app.get("/:id/files", needsPermission("projects.read"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id
+            }
+            runtimeAPI.projects.getFiles(opts).then(function(data) {
+                res.json(data);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+
+        });
+
+
+        // Get file content in a given tree (index/stage)
+        app.get("/:id/files/:treeish/*", needsPermission("projects.read"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.params[0],
+                tree: req.params.treeish
+            }
+            runtimeAPI.projects.getFile(opts).then(function(data) {
+                res.json({content:data});
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Revert a file
+        app.delete("/:id/files/_/*", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.params[0]
+            }
+
+            runtimeAPI.projects.revertFile(opts).then(function() {
+                res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Stage a file
+        app.post("/:id/stage/*", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.params[0]
+            }
+            runtimeAPI.projects.stageFile(opts).then(function() {
+                getProjectStatus(req,res);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Stage multiple files
+        app.post("/:id/stage", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.body.files
+            }
+            runtimeAPI.projects.stageFile(opts).then(function() {
+                getProjectStatus(req,res);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Commit changes
+        app.post("/:id/commit", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                message: req.body.message
+            }
+            runtimeAPI.projects.commit(opts).then(function() {
+                getProjectStatus(req,res);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Unstage a file
+        app.delete("/:id/stage/*", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.params[0]
+            }
+            runtimeAPI.projects.unstageFile(opts).then(function() {
+                getProjectStatus(req,res);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Unstage multiple files
+        app.delete("/:id/stage", needsPermission("projects.write"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id
+            }
+            runtimeAPI.projects.unstageFile(opts).then(function() {
+                getProjectStatus(req,res);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Get a file diff
+        app.get("/:id/diff/:type/*", needsPermission("projects.read"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.params[0],
+                type: req.params.type
+            }
+            runtimeAPI.projects.getFileDiff(opts).then(function(data) {
+                res.json({
+                    diff: data
+                })
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Get a list of commits
+        app.get("/:id/commits", needsPermission("projects.read"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                limit: req.query.limit || 20,
+                before: req.query.before
+            }
+            runtimeAPI.projects.getCommits(opts).then(function(data) {
+                res.json(data);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Get an individual commit details
+        app.get("/:id/commits/:sha", needsPermission("projects.read"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                sha: req.params.sha
+            }
+            runtimeAPI.projects.getCommit(opts).then(function(data) {
+                res.json({commit:data});
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Push local commits to remote
+        app.post("/:id/push/?*", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: req.params[0],
+                track: req.query.u
+            }
+            runtimeAPI.projects.push(opts).then(function(data) {
+                res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Pull remote commits
+        app.post("/:id/pull/?*", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: req.params[0],
+                track: req.query.setUpstream,
+                allowUnrelatedHistories: req.query.allowUnrelatedHistories
+            }
+            runtimeAPI.projects.pull(opts).then(function(data) {
+                res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Abort an ongoing merge
+        app.delete("/:id/merge", needsPermission("projects.write"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id
+            }
+            runtimeAPI.projects.abortMerge(opts).then(function() {
+                res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Resolve a merge
+        app.post("/:id/resolve/*", needsPermission("projects.write"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.params[0],
+                resolution: req.body.resolutions
+            }
+            runtimeAPI.projects.resolveMerge(opts).then(function() {
+                res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Get a list of local branches
+        app.get("/:id/branches", needsPermission("projects.read"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: false
+            }
+            runtimeAPI.projects.getBranches(opts).then(function(data) {
+                res.json(data);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Delete a local branch - ?force=true
+        app.delete("/:id/branches/:branchName", needsPermission("projects.write"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                branch: req.params.branchName,
+                force: !!req.query.force
+            }
+            runtimeAPI.projects.deleteBranch(opts).then(function(data) {
+                res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Get a list of remote branches
+        app.get("/:id/branches/remote", needsPermission("projects.read"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: true
+            }
+            runtimeAPI.projects.getBranches(opts).then(function(data) {
+                res.json(data);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Get branch status - commit counts/ahead/behind
+        app.get("/:id/branches/remote/*/status", needsPermission("projects.read"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                branch: req.params[0]
+            }
+            runtimeAPI.projects.getBranchStatus(opts).then(function(data) {
+                res.json(data);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Set the active local branch
+        app.post("/:id/branches", needsPermission("projects.write"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                branch: req.body.name,
+                create: req.body.create
+            }
+            runtimeAPI.projects.setBranch(opts).then(function(data) {
+                res.json(data);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Get a list of remotes
+        app.get("/:id/remotes", needsPermission("projects.read"), getProjectRemotes);
+
+        // Add a remote
+        app.post("/:id/remotes", needsPermission("projects.write"), function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: req.body
+            }
+            if (/^https?:\/\/[^/]+@/i.test(req.body.url)) {
+                res.status(400).json({error:"unexpected_error", message:"Git http url must not include username/password"});
+                return;
+            }
+            runtimeAPI.projects.addRemote(opts).then(function(data) {
+                getProjectRemotes(req,res);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Delete a remote
+        app.delete("/:id/remotes/:remoteName", needsPermission("projects.write"), function(req, res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: req.params.remoteName
+            }
+            runtimeAPI.projects.removeRemote(opts).then(function(data) {
+                getProjectRemotes(req,res);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        // Update a remote
+        app.put("/:id/remotes/:remoteName", needsPermission("projects.write"), function(req,res) {
+            var remote = req.body || {};
+            remote.name = req.params.remoteName;
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: remote
+            }
+            runtimeAPI.projects.updateRemote(opts).then(function() {
+                res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            })
+        });
+
+        return app;
+    }
+}

packages/node_modules/@node-red/editor-api/lib/editor/settings.js

@@ -0,0 +1,60 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+var apiUtils = require("../util");
+var runtimeAPI;
+var sshkeys = require("./sshkeys");
+var theme = require("./theme");
+
+module.exports = {
+    init: function(_runtimeAPI) {
+        runtimeAPI = _runtimeAPI;
+        sshkeys.init(runtimeAPI);
+    },
+    runtimeSettings: function(req,res) {
+        var opts = {
+            user: req.user
+        }
+        runtimeAPI.settings.getRuntimeSettings(opts).then(function(result) {
+            var themeSettings = theme.settings();
+            if (themeSettings) {
+                result.editorTheme = themeSettings;
+            }
+            res.json(result);
+        });
+    },
+    userSettings: function(req, res) {
+        var opts = {
+            user: req.user
+        }
+        runtimeAPI.settings.getUserSettings(opts).then(function(result) {
+            res.json(result);
+        });
+    },
+    updateUserSettings: function(req,res) {
+        var opts = {
+            user: req.user,
+            settings: req.body
+        }
+        runtimeAPI.settings.updateUserSettings(opts).then(function(result) {
+            res.status(204).end();
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        });
+    },
+    sshkeys: function() {
+        return sshkeys.app()
+    }
+}

packages/node_modules/@node-red/editor-api/lib/editor/sshkeys.js

@@ -0,0 +1,101 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var apiUtils = require("../util");
+var express = require("express");
+var runtimeAPI;
+
+function getUsername(userObj) {
+    var username = '__default';
+    if ( userObj && userObj.name ) {
+        username = userObj.name;
+    }
+    return username;
+}
+
+module.exports = {
+    init: function(_runtimeAPI) {
+        runtimeAPI = _runtimeAPI;
+    },
+    app: function() {
+        var app = express();
+
+        // List all SSH keys
+        app.get("/", function(req,res) {
+            var opts = {
+                user: req.user
+            }
+            runtimeAPI.settings.getUserKeys(opts).then(function(list) {
+                res.json({
+                    keys: list
+                });
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            });
+        });
+
+        // Get SSH key detail
+        app.get("/:id", function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id
+            }
+            runtimeAPI.settings.getUserKey(opts).then(function(data) {
+                res.json({
+                    publickey: data
+                });
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            });
+        });
+
+        // Generate a SSH key
+        app.post("/", function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id
+            }
+            // TODO: validate params
+            opts.name = req.body.name;
+            opts.password = req.body.password;
+            opts.comment = req.body.comment;
+            opts.size = req.body.size;
+
+            runtimeAPI.settings.generateUserKey(opts).then(function(name) {
+                res.json({
+                    name: name
+                });
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            });
+        });
+
+        // Delete a SSH key
+        app.delete("/:id", function(req,res) {
+            var opts = {
+                user: req.user,
+                id: req.params.id
+            }
+            runtimeAPI.settings.removeUserKey(opts).then(function(name) {
+                res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
+            });
+        });
+
+        return app;
+    }
+}

packages/node_modules/@node-red/editor-api/lib/editor/theme.js

@@ -0,0 +1,197 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var express = require("express");
+var util = require("util");
+var path = require("path");
+var fs = require("fs");
+var clone = require("clone");
+
+var defaultContext = {
+    page: {
+        title: "Node-RED",
+        favicon: "favicon.ico",
+        tabicon: "red/images/node-red-icon-black.svg"
+    },
+    header: {
+        title: "Node-RED",
+        image: "red/images/node-red.png"
+    },
+    asset: {
+        red: (process.env.NODE_ENV == "development")? "red/red.js":"red/red.min.js",
+        main: (process.env.NODE_ENV == "development")? "red/main.js":"red/main.min.js",
+
+    }
+};
+
+var theme = null;
+var themeContext = clone(defaultContext);
+var themeSettings = null;
+
+var themeApp;
+
+function serveFile(app,baseUrl,file) {
+    try {
+        var stats = fs.statSync(file);
+        var url = baseUrl+path.basename(file);
+        //console.log(url,"->",file);
+        app.get(url,function(req, res) {
+            res.sendFile(file);
+        });
+        return "theme"+url;
+    } catch(err) {
+        //TODO: log filenotfound
+        return null;
+    }
+}
+
+function serveFilesFromTheme(themeValue, themeApp, directory) {
+    var result = [];
+    if (themeValue) {
+        var array = themeValue;
+        if (!util.isArray(array)) {
+            array = [array];
+        }
+
+        for (var i=0;i<array.length;i++) {
+            var url = serveFile(themeApp,directory,array[i]);
+            if (url) {
+                result.push(url);
+            }
+        }
+    }
+    return result
+}
+
+module.exports = {
+    init: function(settings) {
+        themeContext = clone(defaultContext);
+        themeSettings = null;
+        theme = settings.editorTheme || {};
+    },
+
+    app: function() {
+        var i;
+        var url;
+        themeSettings = {};
+
+        themeApp = express();
+
+        if (theme.page) {
+
+            themeContext.page.css = serveFilesFromTheme(
+                theme.page.css,
+                themeApp,
+                "/css/")
+            themeContext.page.scripts = serveFilesFromTheme(
+                theme.page.scripts,
+                themeApp,
+                "/scripts/")
+
+            if (theme.page.favicon) {
+                url = serveFile(themeApp,"/favicon/",theme.page.favicon)
+                if (url) {
+                    themeContext.page.favicon = url;
+                }
+            }
+
+            if (theme.page.tabicon) {
+                url = serveFile(themeApp,"/tabicon/",theme.page.tabicon)
+                if (url) {
+                    themeContext.page.tabicon = url;
+                }
+            }
+
+            themeContext.page.title = theme.page.title || themeContext.page.title;
+        }
+
+        if (theme.header) {
+
+            themeContext.header.title = theme.header.title || themeContext.header.title;
+
+            if (theme.header.hasOwnProperty("url")) {
+                themeContext.header.url = theme.header.url;
+            }
+
+            if (theme.header.hasOwnProperty("image")) {
+                if (theme.header.image) {
+                    url = serveFile(themeApp,"/header/",theme.header.image);
+                    if (url) {
+                        themeContext.header.image = url;
+                    }
+                } else {
+                    themeContext.header.image = null;
+                }
+            }
+        }
+
+        if (theme.deployButton) {
+            if (theme.deployButton.type == "simple") {
+                themeSettings.deployButton = {
+                    type: "simple"
+                }
+                if (theme.deployButton.label) {
+                    themeSettings.deployButton.label = theme.deployButton.label;
+                }
+                if (theme.deployButton.icon) {
+                    url = serveFile(themeApp,"/deploy/",theme.deployButton.icon);
+                    if (url) {
+                        themeSettings.deployButton.icon = url;
+                    }
+                }
+            }
+        }
+
+        if (theme.hasOwnProperty("userMenu")) {
+            themeSettings.userMenu = theme.userMenu;
+        }
+
+        if (theme.login) {
+            if (theme.login.image) {
+                url = serveFile(themeApp,"/login/",theme.login.image);
+                if (url) {
+                    themeContext.login = {
+                        image: url
+                    }
+                }
+            }
+        }
+
+        if (theme.hasOwnProperty("menu")) {
+            themeSettings.menu = theme.menu;
+        }
+
+        if (theme.hasOwnProperty("palette")) {
+            themeSettings.palette = theme.palette;
+        }
+
+        if (theme.hasOwnProperty("projects")) {
+            themeSettings.projects = theme.projects;
+        }
+
+
+        return themeApp;
+    },
+    context: function() {
+        return themeContext;
+    },
+    settings: function() {
+        return themeSettings;
+    },
+    serveFile: function(baseUrl,file) {
+        return serveFile(themeApp,baseUrl,file);
+    }
+}

packages/node_modules/@node-red/editor-api/lib/editor/ui.js

@@ -0,0 +1,75 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+var express = require('express');
+var fs = require("fs");
+var path = require("path");
+var Mustache = require("mustache");
+var mime = require("mime");
+
+var apiUtils = require("../util");
+
+var theme = require("./theme");
+
+var runtimeAPI;
+var editorClientDir = path.dirname(require.resolve("@node-red/editor-client"));
+var defaultNodeIcon = path.join(editorClientDir,"public","red","images","icons","arrow-in.png");
+var editorTemplatePath = path.join(editorClientDir,"templates","index.mst");
+var editorTemplate;
+
+module.exports = {
+    init: function(_runtimeAPI) {
+        runtimeAPI = _runtimeAPI;
+        editorTemplate = fs.readFileSync(editorTemplatePath,"utf8");
+        Mustache.parse(editorTemplate);
+    },
+
+    ensureSlash: function(req,res,next) {
+        var parts = req.originalUrl.split("?");
+        if (parts[0].slice(-1) != "/") {
+            parts[0] += "/";
+            var redirect = parts.join("?");
+            res.redirect(301,redirect);
+        } else {
+            next();
+        }
+    },
+    icon: function(req,res) {
+        var icon = req.params.icon;
+        var scope = req.params.scope;
+        var module = scope ? scope + '/' +  req.params.module : req.params.module;
+        var opts = {
+            user: req.user,
+            module: module,
+            icon: icon
+        }
+        runtimeAPI.nodes.getIcon(opts).then(function(data) {
+            if (data) {
+                var contentType = mime.lookup(icon);
+                res.set("Content-Type", contentType);
+                res.send(data);
+            } else {
+                res.sendFile(defaultNodeIcon);
+            }
+        }).catch(function(err) {
+            console.log(err.stack);
+            apiUtils.rejectHandler(req,res,err);
+        })
+    },
+    editor: function(req,res) {
+        res.send(Mustache.render(editorTemplate,theme.context()));
+    },
+    editorResources: express.static(path.join(editorClientDir,'public'))
+};

packages/node_modules/@node-red/editor-api/lib/index.js

@@ -0,0 +1,105 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var express = require("express");
+var bodyParser = require("body-parser");
+var util = require('util');
+var passport = require('passport');
+var when = require('when');
+var cors = require('cors');
+
+var auth = require("./auth");
+var apiUtil = require("./util");
+
+var adminApp;
+var server;
+var editor;
+
+function init(_server,settings,storage,runtimeAPI) {
+    server = _server;
+    if (settings.httpAdminRoot !== false) {
+        adminApp = express();
+
+        var cors = require('cors');
+        var corsHandler = cors({
+           origin: "*",
+           methods: "GET,PUT,POST,DELETE"
+        });
+        adminApp.use(corsHandler);
+
+        auth.init(settings,storage);
+
+        var maxApiRequestSize = settings.apiMaxLength || '5mb';
+        adminApp.use(bodyParser.json({limit:maxApiRequestSize}));
+        adminApp.use(bodyParser.urlencoded({limit:maxApiRequestSize,extended:true}));
+
+        adminApp.get("/auth/login",auth.login,apiUtil.errorHandler);
+        if (settings.adminAuth) {
+            if (settings.adminAuth.type === "strategy") {
+                auth.genericStrategy(adminApp,settings.adminAuth.strategy);
+            } else if (settings.adminAuth.type === "credentials") {
+                adminApp.use(passport.initialize());
+                adminApp.post("/auth/token",
+                    auth.ensureClientSecret,
+                    auth.authenticateClient,
+                    auth.getToken,
+                    auth.errorHandler
+                );
+            }
+            adminApp.post("/auth/revoke",auth.needsPermission(""),auth.revoke,apiUtil.errorHandler);
+        }
+
+        // Editor
+        if (!settings.disableEditor) {
+            editor = require("./editor");
+            var editorApp = editor.init(server, settings, runtimeAPI);
+            adminApp.use(editorApp);
+        }
+
+        if (settings.httpAdminCors) {
+            var corsHandler = cors(settings.httpAdminCors);
+            adminApp.use(corsHandler);
+        }
+
+        var adminApiApp = require("./admin").init(runtimeAPI);
+        adminApp.use(adminApiApp);
+    } else {
+        adminApp = null;
+    }
+}
+function start() {
+    if (editor) {
+        return editor.start();
+    } else {
+        return when.resolve();
+    }
+}
+function stop() {
+    if (editor) {
+        editor.stop();
+    }
+    return when.resolve();
+}
+module.exports = {
+    init: init,
+    start: start,
+    stop: stop,
+    auth: {
+        needsPermission: auth.needsPermission
+    },
+    get adminApp() { return adminApp; },
+    get server() { return server; }
+};

packages/node_modules/@node-red/editor-api/lib/util.js

@@ -0,0 +1,47 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+
+var log = require("@node-red/util").log; // TODO: separate module
+var i18n = require("@node-red/util").i18n; // TODO: separate module
+
+
+module.exports = {
+    errorHandler: function(err,req,res,next) {
+        if (err.message === "request entity too large") {
+            log.error(err);
+        } else {
+            log.error(err.stack);
+        }
+        log.audit({event: "api.error",error:err.code||"unexpected_error",message:err.toString()},req);
+        res.status(400).json({error:"unexpected_error", message:err.toString()});
+    },
+
+    determineLangFromHeaders: function(acceptedLanguages){
+        var lang = i18n.defaultLang;
+        acceptedLanguages = acceptedLanguages || [];
+        if (acceptedLanguages.length >= 1) {
+            lang = acceptedLanguages[0];
+        }
+        return lang;
+    },
+    rejectHandler: function(req,res,err) {
+        res.status(err.status||500).json({
+            code: err.code||"unexpected_error",
+            message: err.message||err.toString()
+        });
+    }
+}