calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-09 22:17:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'dev' into refactor/show-if-client-needs-update

Browse Source
This commit is contained in:
Fred KISSIE
2026-06-11 21:05:31 +02:00
parent 4b703b5c11 5baf0c3c09
commit 7a275c86c2
199 changed files with 3020 additions and 2228 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/db/pg/driver.ts
+1 -1
View File
@@ -87,7 +87,7 @@ function createDb() {
export const db = createDb();
export default db;
export const primaryDb = db.$primary as typeof db; // is this typeof a problem - techincally they are different types
export const primaryDb = db.$primary as typeof db; // is this typeof a problem - technically they are different types
export type Transaction = Parameters<
Parameters<(typeof db)["transaction"]>[0]
>[0];
server/db/pg/logsDriver.ts
+3 -4
View File
@@ -2,7 +2,7 @@ import { drizzle as DrizzlePostgres } from "drizzle-orm/node-postgres";
import { readConfigFile } from "@server/lib/readConfigFile";
import { withReplicas } from "drizzle-orm/pg-core";
import { build } from "@server/build";
import { db as mainDb, primaryDb as mainPrimaryDb } from "./driver";
import { db as mainDb } from "./driver";
import { createPool } from "./poolConfig";
function createLogsDb() {
@@ -63,8 +63,7 @@ function createLogsDb() {
})
);
} else {
const maxReplicaConnections =
poolConfig?.max_replica_connections || 20;
const maxReplicaConnections = poolConfig?.max_replica_connections || 20;
for (const conn of replicaConnections) {
const replicaPool = createPool(
conn.connection_string,
@@ -91,4 +90,4 @@ function createLogsDb() {
export const logsDb = createLogsDb();
export default logsDb;
export const primaryLogsDb = logsDb.$primary;
export const primaryLogsDb = logsDb.$primary;
server/db/pg/poolConfig.ts
+3 -4
View File
@@ -1,5 +1,4 @@
import { Pool, PoolConfig } from "pg";
import logger from "@server/logger";
export function createPoolConfig(
connectionString: string,
@@ -27,7 +26,7 @@ export function attachPoolErrorHandlers(pool: Pool, label: string): void {
pool.on("error", (err) => {
// This catches errors on idle clients in the pool. Without this
// handler an unexpected disconnect would crash the process.
logger.error(
console.error(
`Unexpected error on idle ${label} database client: ${err.message}`
);
});
@@ -36,7 +35,7 @@ export function attachPoolErrorHandlers(pool: Pool, label: string): void {
// Set a statement timeout on every new connection so a single slow
// query can't block the pool forever
client.query("SET statement_timeout = '30s'").catch((err: Error) => {
logger.warn(
console.warn(
`Failed to set statement_timeout on ${label} client: ${err.message}`
);
});
@@ -60,4 +59,4 @@ export function createPool(
);
attachPoolErrorHandlers(pool, label);
return pool;
}
}
server/db/pg/schema/schema.ts
+3 -5
View File
@@ -147,12 +147,10 @@ export const resources = pgTable("resources", {
}),
ssl: boolean("ssl").notNull().default(false),
blockAccess: boolean("blockAccess").notNull().default(false),
sso: boolean("sso").notNull().default(true),
proxyPort: integer("proxyPort"),
emailWhitelistEnabled: boolean("emailWhitelistEnabled")
.notNull()
.default(false),
applyRules: boolean("applyRules").notNull().default(false),
sso: boolean("sso"),
emailWhitelistEnabled: boolean("emailWhitelistEnabled"),
applyRules: boolean("applyRules"),
enabled: boolean("enabled").notNull().default(true),
stickySession: boolean("stickySession").notNull().default(false),
tlsServerName: varchar("tlsServerName"),
server/db/queries/verifySessionQueries.ts
+3 -3
View File
@@ -45,9 +45,9 @@ export type ResourceWithAuth = {
password: ResourcePassword | ResourcePolicyPassword | null;
headerAuth: ResourceHeaderAuth | ResourcePolicyHeaderAuth | null;
headerAuthExtendedCompatibility: ResourceHeaderAuthExtendedCompatibility | null;
applyRules: boolean;
sso: boolean;
emailWhitelistEnabled: boolean;
applyRules: boolean | null;
sso: boolean | null;
emailWhitelistEnabled: boolean | null;
org: Org;
};
server/db/sqlite/schema/schema.ts
+5 -7
View File
@@ -165,14 +165,12 @@ export const resources = sqliteTable("resources", {
blockAccess: integer("blockAccess", { mode: "boolean" })
.notNull()
.default(false),
sso: integer("sso", { mode: "boolean" }).notNull().default(true),
proxyPort: integer("proxyPort"),
emailWhitelistEnabled: integer("emailWhitelistEnabled", { mode: "boolean" })
.notNull()
.default(false),
applyRules: integer("applyRules", { mode: "boolean" })
.notNull()
.default(false),
sso: integer("sso", { mode: "boolean" }),
emailWhitelistEnabled: integer("emailWhitelistEnabled", {
mode: "boolean"
}),
applyRules: integer("applyRules", { mode: "boolean" }),
enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
stickySession: integer("stickySession", { mode: "boolean" })
.notNull()
server/integrationApiServer.ts
+3 -1
View File
@@ -157,7 +157,9 @@ function getOpenApiDocumentation() {
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z
.record(z.string(), z.any())
.nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/lib/billing/tierMatrix.ts
+3 -13
View File
@@ -31,7 +31,7 @@ export enum TierFeature {
}
export const tierMatrix: Record<TierFeature, Tier[]> = {
[TierFeature.Labels]: ["tier2", "tier3", "enterprise"],
[TierFeature.Labels]: ["tier1", "tier2", "tier3", "enterprise"],
[TierFeature.OrgOidc]: ["tier1", "tier2", "tier3", "enterprise"],
[TierFeature.LoginPageDomain]: ["tier1", "tier2", "tier3", "enterprise"],
[TierFeature.DeviceApprovals]: ["tier1", "tier3", "enterprise"],
@@ -71,16 +71,6 @@ export const tierMatrix: Record<TierFeature, Tier[]> = {
[TierFeature.WildcardSubdomain]: ["tier1", "tier2", "tier3", "enterprise"],
[TierFeature.NewtAutoUpdate]: ["tier1", "tier2", "tier3", "enterprise"],
[TierFeature.ResourcePolicies]: ["tier3", "enterprise"],
[TierFeature.AdvancedPublicResources]: [
"tier1",
"tier2",
"tier3",
"enterprise"
],
[TierFeature.AdvancedPrivateResources]: [
"tier1",
"tier2",
"tier3",
"enterprise"
]
[TierFeature.AdvancedPublicResources]: ["tier3", "enterprise"],
[TierFeature.AdvancedPrivateResources]: ["tier3", "enterprise"]
};
server/lib/blueprints/privateResources.ts
+5 -1
View File
@@ -415,7 +415,11 @@ export async function updatePrivateResources(
} else {
let aliasAddress: string | null = null;
let releaseAliasLock: (() => Promise<void>) | null = null;
if (resourceData.mode === "host" || resourceData.mode === "http") {
if (
resourceData.mode === "host" ||
resourceData.mode === "http" ||
resourceData.mode === "ssh"
) {
const { value, release } = await getNextAvailableAliasAddress(
orgId,
trx
server/lib/blueprints/publicResources.ts
-11
View File
@@ -1467,17 +1467,6 @@ async function syncWhitelistUsers(
.where(eq(resourceWhitelist.resourceId, resourceId));
for (const email of whitelistUsers) {
const [user] = await trx
.select()
.from(users)
.innerJoin(userOrgs, eq(users.userId, userOrgs.userId))
.where(and(eq(users.email, email), eq(userOrgs.orgId, orgId)))
.limit(1);
if (!user) {
throw new Error(`User not found: ${email} in org ${orgId}`);
}
const existingWhitelistEntry = existingWhitelist.find(
(w) => w.email === email
);
server/lib/blueprints/types.ts
+23 -2
View File
@@ -1,8 +1,23 @@
import { z } from "zod";
import { existsSync } from "node:fs";
import { portRangeStringSchema } from "@server/lib/ip";
import { MaintenanceSchema } from "#dynamic/lib/blueprints/MaintenanceSchema";
import { isValidRegionId } from "@server/db/regions";
import { wildcardSubdomainSchema } from "@server/lib/schemas";
import config from "@server/lib/config";
const maxmindDbPath = config.getRawConfig().server.maxmind_db_path;
const maxmindAsnPath = config.getRawConfig().server.maxmind_asn_path;
const hasMaxmindCountryDb =
typeof maxmindDbPath === "string" &&
maxmindDbPath.length > 0 &&
existsSync(maxmindDbPath);
const hasMaxmindAsnDb =
typeof maxmindAsnPath === "string" &&
maxmindAsnPath.length > 0 &&
existsSync(maxmindAsnPath);
export const SiteSchema = z.object({
name: z.string().min(1).max(100),
@@ -117,6 +132,9 @@ export const RuleSchema = z
.refine(
(rule) => {
if (rule.match === "country") {
if (!hasMaxmindCountryDb) {
return false;
}
// Check if it's a valid 2-letter country code or "ALL"
return /^[A-Z]{2}$/.test(rule.value) || rule.value === "ALL";
}
@@ -125,12 +143,15 @@ export const RuleSchema = z
{
path: ["value"],
message:
"Value must be a 2-letter country code or 'ALL' when match is 'country'"
"Country rules require a valid existing server.maxmind_db_path and value must be a 2-letter country code or 'ALL'"
}
)
.refine(
(rule) => {
if (rule.match === "asn") {
if (!hasMaxmindCountryDb || !hasMaxmindAsnDb) {
return false;
}
// Check if it's either AS<number> format or "ALL"
const asNumberPattern = /^AS\d+$/i;
return asNumberPattern.test(rule.value) || rule.value === "ALL";
@@ -140,7 +161,7 @@ export const RuleSchema = z
{
path: ["value"],
message:
"Value must be 'AS<number>' format or 'ALL' when match is 'asn'"
"ASN rules require valid existing server.maxmind_db_path and server.maxmind_asn_path, and value must be 'AS<number>' format or 'ALL'"
}
)
.refine(
server/lib/ip.ts
+14 -5
View File
@@ -504,7 +504,7 @@ export function generateRemoteSubnets(
const parseResult = cidrSchema.safeParse(sr.destination);
return parseResult.success;
}
if (sr.mode === "host") {
if (sr.mode === "host" || sr.mode === "ssh") {
// check if its a valid IP using zod
const ipSchema = z.union([z.ipv4(), z.ipv6()]);
const parseResult = ipSchema.safeParse(sr.destination);
@@ -514,7 +514,7 @@ export function generateRemoteSubnets(
})
.map((sr) => {
if (sr.mode === "cidr") return sr.destination;
if (sr.mode === "host") {
if (sr.mode === "host" || sr.mode === "ssh") {
return `${sr.destination}/32`;
}
return ""; // This should never be reached due to filtering, but satisfies TypeScript
@@ -531,7 +531,7 @@ export function generateAliasConfig(allSiteResources: SiteResource[]): Alias[] {
.filter(
(sr) =>
sr.aliasAddress &&
((sr.alias && sr.mode == "host") ||
((sr.alias && (sr.mode == "host" || sr.mode == "ssh")) ||
(sr.fullDomain && sr.mode == "http"))
)
.map((sr) => ({
@@ -577,6 +577,10 @@ export function generateSubnetProxyTargets(
continue;
}
if (!siteResource.destination) {
continue;
}
const clientPrefix = `${clientSite.subnet.split("/")[0]}/32`;
const portRange = [
...parsePortRangeString(siteResource.tcpPortRangeString, "tcp"),
@@ -584,7 +588,7 @@ export function generateSubnetProxyTargets(
];
const disableIcmp = siteResource.disableIcmp ?? false;
if (siteResource.mode == "host") {
if (siteResource.mode == "host" || siteResource.mode == "ssh") {
let destination = siteResource.destination;
// check if this is a valid ip
const ipSchema = z.union([z.ipv4(), z.ipv6()]);
@@ -665,6 +669,11 @@ export async function generateSubnetProxyTargetV2(
return;
}
if (!siteResource.destination) {
// ssh can have no destination
return;
}
const targets: SubnetProxyTargetV2[] = [];
const portRange = [
@@ -673,7 +682,7 @@ export async function generateSubnetProxyTargetV2(
];
const disableIcmp = siteResource.disableIcmp ?? false;
if (siteResource.mode == "host") {
if (siteResource.mode == "host" || siteResource.mode == "ssh") {
let destination = siteResource.destination;
// check if this is a valid ip
const ipSchema = z.union([z.ipv4(), z.ipv6()]);
server/lib/telemetry.ts
+4
View File
@@ -181,6 +181,7 @@ class TelemetryClient {
let numPrivResourceHosts = 0;
let numPrivResourceCidr = 0;
let numPrivResourceHttp = 0;
let numPrivResourceSsh = 0;
for (const res of allPrivateResources) {
if (res.mode === "host") {
numPrivResourceHosts += 1;
@@ -188,6 +189,8 @@ class TelemetryClient {
numPrivResourceCidr += 1;
} else if (res.mode === "http") {
numPrivResourceHttp += 1;
} else if (res.mode === "ssh") {
numPrivResourceSsh += 1;
}
if (res.alias) {
@@ -207,6 +210,7 @@ class TelemetryClient {
numPrivateResourceHosts: numPrivResourceHosts,
numPrivateResourceCidr: numPrivResourceCidr,
numPrivateResourceHttp: numPrivResourceHttp,
numPrivateResourceSsh: numPrivResourceSsh,
numAlertRules: numAlertRules.count,
numUserDevices: userDevicesCount.count,
numMachineClients: machineClients.count,
server/middlewares/verifyResourceAccess.ts
+17 -28
View File
@@ -1,11 +1,15 @@
import { Request, Response, NextFunction } from "express";
import { db, Resource } from "@server/db";
import { resources, userOrgs, userResources, roleResources } from "@server/db";
import { and, eq, inArray } from "drizzle-orm";
import { resources, userOrgs } from "@server/db";
import { and, eq } from "drizzle-orm";
import createHttpError from "http-errors";
import HttpCode from "@server/types/HttpCode";
import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
import {
getRoleResourceAccess,
getUserResourceAccess
} from "@server/db/queries/verifySessionQueries";
export async function verifyResourceAccess(
req: Request,
@@ -116,37 +120,22 @@ export async function verifyResourceAccess(
const roleResourceAccess =
(req.userOrgRoleIds?.length ?? 0) > 0
? await db
.select()
.from(roleResources)
.where(
and(
eq(roleResources.resourceId, resource.resourceId),
inArray(
roleResources.roleId,
req.userOrgRoleIds!
)
)
)
.limit(1)
: [];
? await getRoleResourceAccess(
resource.resourceId,
req.userOrgRoleIds!
)
: null;
if (roleResourceAccess.length > 0) {
if (roleResourceAccess) {
return next();
}
const userResourceAccess = await db
.select()
.from(userResources)
.where(
and(
eq(userResources.userId, userId),
eq(userResources.resourceId, resource.resourceId)
)
)
.limit(1);
const userResourceAccess = await getUserResourceAccess(
userId,
resource.resourceId
);
if (userResourceAccess.length > 0) {
if (userResourceAccess) {
return next();
}
server/private/routers/alertRule/createAlertRule.ts
+1 -1
View File
@@ -208,7 +208,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/private/routers/alertRule/deleteAlertRule.ts
+2 -2
View File
@@ -44,7 +44,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
@@ -112,4 +112,4 @@ export async function deleteAlertRule(
createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
);
}
}
}
server/private/routers/alertRule/getAlertRule.ts
+5 -2
View File
@@ -32,7 +32,10 @@ import { OpenAPITags, registry } from "@server/openApi";
import { and, eq } from "drizzle-orm";
import { decrypt } from "@server/lib/crypto";
import config from "@server/lib/config";
import { GetAlertRuleResponse, WebhookAlertConfig } from "@server/routers/alertRule/types";
import {
GetAlertRuleResponse,
WebhookAlertConfig
} from "@server/routers/alertRule/types";
const paramsSchema = z
.object({
@@ -55,7 +58,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/private/routers/alertRule/listAlertRules.ts
+1 -1
View File
@@ -101,7 +101,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/private/routers/auditLogs/exportAccessAuditLog.ts
+1 -1
View File
@@ -44,7 +44,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/private/routers/auditLogs/exportActionAuditLog.ts
+1 -1
View File
@@ -44,7 +44,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/private/routers/auditLogs/exportConnectionAuditLog.ts
+5 -3
View File
@@ -44,7 +44,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
@@ -72,7 +72,9 @@ export async function exportConnectionAuditLogs(
);
}
const parsedParams = queryConnectionAuditLogsParams.safeParse(req.params);
const parsedParams = queryConnectionAuditLogsParams.safeParse(
req.params
);
if (!parsedParams.success) {
return next(
createHttpError(
@@ -112,4 +114,4 @@ export async function exportConnectionAuditLogs(
createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
);
}
}
}
server/private/routers/auditLogs/queryAccessAuditLog.ts
+37 -15
View File
@@ -11,7 +11,14 @@
* This file is not licensed under the AGPLv3.
*/
import { accessAuditLog, logsDb, resources, siteResources, db, primaryDb } from "@server/db";
import {
accessAuditLog,
logsDb,
resources,
siteResources,
db,
primaryDb
} from "@server/db";
import { registry } from "@server/openApi";
import { NextFunction } from "express";
import { Request, Response } from "express";
@@ -150,21 +157,30 @@ export function queryAccess(data: Q) {
.orderBy(desc(accessAuditLog.timestamp), desc(accessAuditLog.id));
}
async function enrichWithResourceDetails(logs: Awaited<ReturnType<typeof queryAccess>>) {
async function enrichWithResourceDetails(
logs: Awaited<ReturnType<typeof queryAccess>>
) {
const resourceIds = logs
.map(log => log.resourceId)
.map((log) => log.resourceId)
.filter((id): id is number => id !== null && id !== undefined);
const siteResourceIds = logs
.filter(log => log.resourceId == null && log.siteResourceId != null)
.map(log => log.siteResourceId)
.filter((log) => log.resourceId == null && log.siteResourceId != null)
.map((log) => log.siteResourceId)
.filter((id): id is number => id !== null && id !== undefined);
if (resourceIds.length === 0 && siteResourceIds.length === 0) {
return logs.map(log => ({ ...log, resourceName: null, resourceNiceId: null }));
return logs.map((log) => ({
...log,
resourceName: null,
resourceNiceId: null
}));
}
const resourceMap = new Map<number, { name: string | null; niceId: string | null }>();
const resourceMap = new Map<
number,
{ name: string | null; niceId: string | null }
>();
if (resourceIds.length > 0) {
const resourceDetails = await primaryDb
@@ -181,7 +197,10 @@ async function enrichWithResourceDetails(logs: Awaited<ReturnType<typeof queryAc
}
}
const siteResourceMap = new Map<number, { name: string | null; niceId: string | null }>();
const siteResourceMap = new Map<
number,
{ name: string | null; niceId: string | null }
>();
if (siteResourceIds.length > 0) {
const siteResourceDetails = await primaryDb
@@ -194,12 +213,15 @@ async function enrichWithResourceDetails(logs: Awaited<ReturnType<typeof queryAc
.where(inArray(siteResources.siteResourceId, siteResourceIds));
for (const r of siteResourceDetails) {
siteResourceMap.set(r.siteResourceId, { name: r.name, niceId: r.niceId });
siteResourceMap.set(r.siteResourceId, {
name: r.name,
niceId: r.niceId
});
}
}
// Enrich logs with resource details
return logs.map(log => {
return logs.map((log) => {
if (log.resourceId != null) {
const details = resourceMap.get(log.resourceId);
return {
@@ -273,11 +295,11 @@ async function queryUniqueFilterAttributes(
// Fetch resource names from main database for the unique resource IDs
const resourceIds = uniqueResources
.map(row => row.id)
.map((row) => row.id)
.filter((id): id is number => id !== null);
const siteResourceIds = uniqueSiteResources
.map(row => row.id)
.map((row) => row.id)
.filter((id): id is number => id !== null);
let resourcesWithNames: Array<{ id: number; name: string | null }> = [];
@@ -293,7 +315,7 @@ async function queryUniqueFilterAttributes(
resourcesWithNames = [
...resourcesWithNames,
...resourceDetails.map(r => ({
...resourceDetails.map((r) => ({
id: r.resourceId,
name: r.name
}))
@@ -311,7 +333,7 @@ async function queryUniqueFilterAttributes(
resourcesWithNames = [
...resourcesWithNames,
...siteResourceDetails.map(r => ({
...siteResourceDetails.map((r) => ({
id: r.siteResourceId,
name: r.name
}))
@@ -344,7 +366,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/private/routers/auditLogs/queryActionAuditLog.ts
+1 -1
View File
@@ -171,7 +171,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/private/routers/auditLogs/queryConnectionAuditLog.ts
+1 -1
View File
@@ -459,7 +459,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/private/routers/auth/transferSession.ts
+14 -11
View File
@@ -17,8 +17,7 @@ import createHttpError from "http-errors";
import { z } from "zod";
import { fromError } from "zod-validation-error";
import logger from "@server/logger";
import { sessions, sessionTransferToken } from "@server/db";
import { db } from "@server/db";
import { db, safeRead, sessions, sessionTransferToken } from "@server/db";
import { eq } from "drizzle-orm";
import { response } from "@server/lib/response";
import { encodeHexLowerCase } from "@oslojs/encoding";
@@ -57,15 +56,19 @@ export async function transferSession(
sha256(new TextEncoder().encode(token))
);
const [existing] = await db
.select()
.from(sessionTransferToken)
.where(eq(sessionTransferToken.token, tokenRaw))
.innerJoin(
sessions,
eq(sessions.sessionId, sessionTransferToken.sessionId)
)
.limit(1);
const result = await safeRead((db) =>
db
.select()
.from(sessionTransferToken)
.where(eq(sessionTransferToken.token, tokenRaw))
.innerJoin(
sessions,
eq(sessions.sessionId, sessionTransferToken.sessionId)
)
.limit(1)
);
const [existing] = result;
if (!existing) {
return next(
server/private/routers/billing/getOrgUsage.ts
+1 -1
View File
@@ -45,7 +45,7 @@ const getOrgSchema = z.strictObject({
// content: {
// "application/json": {
// schema: z.object({
// data: z.unknown().nullable(),
// data: z.record(z.string(), z.any()).nullable(),
// success: z.boolean(),
// error: z.boolean(),
// message: z.string(),
server/private/routers/certificates/getCertificate.ts
+1 -1
View File
@@ -121,7 +121,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/private/routers/certificates/restartCertificate.ts
+1 -1
View File
@@ -46,7 +46,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/private/routers/domain/checkDomainNamespaceAvailability.ts
+2 -2
View File
@@ -29,7 +29,7 @@ import { tierMatrix } from "@server/lib/billing/tierMatrix";
const paramsSchema = z.strictObject({});
const querySchema = z.strictObject({
subdomain: z.string(),
subdomain: z.string()
// orgId: build === "saas" ? z.string() : z.string().optional() // Required for saas, optional otherwise
});
@@ -48,7 +48,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/private/routers/eventStreamingDestination/deleteEventStreamingDestination.ts
+4 -3
View File
@@ -33,7 +33,8 @@ const paramsSchema = z
registry.registerPath({
method: "delete",
path: "/org/{orgId}/event-streaming-destination/{destinationId}",
description: "Delete an event streaming destination for a specific organization.",
description:
"Delete an event streaming destination for a specific organization.",
tags: [OpenAPITags.Org],
request: {
params: paramsSchema
@@ -44,7 +45,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
@@ -115,4 +116,4 @@ export async function deleteEventStreamingDestination(
createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
);
}
}
}
server/private/routers/healthChecks/deleteHealthCheck.ts
+1 -1
View File
@@ -47,7 +47,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/private/routers/healthChecks/listHealthChecks.ts
+1 -1
View File
@@ -74,7 +74,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/private/routers/hybrid.ts
+3 -3
View File
@@ -219,9 +219,9 @@ export type ResourceWithAuth = {
password: ResourcePassword | ResourcePolicyPassword | null;
headerAuth: ResourceHeaderAuth | ResourcePolicyHeaderAuth | null;
headerAuthExtendedCompatibility: ResourceHeaderAuthExtendedCompatibility | null;
applyRules: boolean;
sso: boolean;
emailWhitelistEnabled: boolean;
applyRules: boolean | null;
sso: boolean | null;
emailWhitelistEnabled: boolean | null;
org: Org;
};
server/private/routers/orgIdp/createOrgOidcIdp.ts
+3 -2
View File
@@ -69,7 +69,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
@@ -127,7 +127,8 @@ export async function createOrgOidcIdp(
let { autoProvision } = parsedBody.data;
if (build == "saas") { // this is not paywalled with a ee license because this whole endpoint is restricted
if (build == "saas") {
// this is not paywalled with a ee license because this whole endpoint is restricted
const subscribed = await isSubscribed(
orgId,
tierMatrix.deviceApprovals
server/private/routers/orgIdp/deleteOrgIdp.ts
+1 -1
View File
@@ -44,7 +44,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/private/routers/orgIdp/getOrgIdp.ts
+1 -1
View File
@@ -62,7 +62,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/private/routers/orgIdp/listOrgIdps.ts
+1 -1
View File
@@ -78,7 +78,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/private/routers/user/addUserRole.ts
+1 -1
View File
@@ -44,7 +44,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/private/routers/user/removeUserRole.ts
+1 -1
View File
@@ -45,7 +45,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/accessToken/deleteAccessToken.ts
+1 -1
View File
@@ -28,7 +28,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/accessToken/generateAccessToken.ts
+1 -1
View File
@@ -61,7 +61,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/accessToken/listAccessTokens.ts
+2 -2
View File
@@ -135,7 +135,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
@@ -164,7 +164,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/apiKeys/deleteApiKey.ts
+1 -1
View File
@@ -28,7 +28,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/apiKeys/setApiKeyActions.ts
+1 -1
View File
@@ -42,7 +42,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/auditLogs/exportRequestAuditLog.ts
+1 -1
View File
@@ -35,7 +35,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/auditLogs/queryRequestAnalytics.ts
+1 -1
View File
@@ -162,7 +162,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/auditLogs/queryRequestAuditLog.ts
+47 -25
View File
@@ -1,4 +1,11 @@
import { logsDb, requestAuditLog, resources, siteResources, db, primaryDb } from "@server/db";
import {
logsDb,
requestAuditLog,
resources,
siteResources,
db,
primaryDb
} from "@server/db";
import { registry } from "@server/openApi";
import { NextFunction } from "express";
import { Request, Response } from "express";
@@ -127,16 +134,16 @@ export function queryRequest(data: Q) {
return logsDb
.select({
id: requestAuditLog.id,
timestamp: requestAuditLog.timestamp,
orgId: requestAuditLog.orgId,
action: requestAuditLog.action,
reason: requestAuditLog.reason,
actorType: requestAuditLog.actorType,
actor: requestAuditLog.actor,
actorId: requestAuditLog.actorId,
resourceId: requestAuditLog.resourceId,
siteResourceId: requestAuditLog.siteResourceId,
ip: requestAuditLog.ip,
timestamp: requestAuditLog.timestamp,
orgId: requestAuditLog.orgId,
action: requestAuditLog.action,
reason: requestAuditLog.reason,
actorType: requestAuditLog.actorType,
actor: requestAuditLog.actor,
actorId: requestAuditLog.actorId,
resourceId: requestAuditLog.resourceId,
siteResourceId: requestAuditLog.siteResourceId,
ip: requestAuditLog.ip,
location: requestAuditLog.location,
userAgent: requestAuditLog.userAgent,
metadata: requestAuditLog.metadata,
@@ -154,21 +161,30 @@ export function queryRequest(data: Q) {
.orderBy(desc(requestAuditLog.timestamp));
}
async function enrichWithResourceDetails(logs: Awaited<ReturnType<typeof queryRequest>>) {
async function enrichWithResourceDetails(
logs: Awaited<ReturnType<typeof queryRequest>>
) {
const resourceIds = logs
.map(log => log.resourceId)
.map((log) => log.resourceId)
.filter((id): id is number => id !== null && id !== undefined);
const siteResourceIds = logs
.filter(log => log.resourceId == null && log.siteResourceId != null)
.map(log => log.siteResourceId)
.filter((log) => log.resourceId == null && log.siteResourceId != null)
.map((log) => log.siteResourceId)
.filter((id): id is number => id !== null && id !== undefined);
if (resourceIds.length === 0 && siteResourceIds.length === 0) {
return logs.map(log => ({ ...log, resourceName: null, resourceNiceId: null }));
return logs.map((log) => ({
...log,
resourceName: null,
resourceNiceId: null
}));
}
const resourceMap = new Map<number, { name: string | null; niceId: string | null }>();
const resourceMap = new Map<
number,
{ name: string | null; niceId: string | null }
>();
if (resourceIds.length > 0) {
const resourceDetails = await primaryDb
@@ -185,7 +201,10 @@ async function enrichWithResourceDetails(logs: Awaited<ReturnType<typeof queryRe
}
}
const siteResourceMap = new Map<number, { name: string | null; niceId: string | null }>();
const siteResourceMap = new Map<
number,
{ name: string | null; niceId: string | null }
>();
if (siteResourceIds.length > 0) {
const siteResourceDetails = await primaryDb
@@ -198,12 +217,15 @@ async function enrichWithResourceDetails(logs: Awaited<ReturnType<typeof queryRe
.where(inArray(siteResources.siteResourceId, siteResourceIds));
for (const r of siteResourceDetails) {
siteResourceMap.set(r.siteResourceId, { name: r.name, niceId: r.niceId });
siteResourceMap.set(r.siteResourceId, {
name: r.name,
niceId: r.niceId
});
}
}
// Enrich logs with resource details
return logs.map(log => {
return logs.map((log) => {
if (log.resourceId != null) {
const details = resourceMap.get(log.resourceId);
return {
@@ -247,7 +269,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
@@ -333,11 +355,11 @@ async function queryUniqueFilterAttributes(
// Fetch resource names from main database for the unique resource IDs
const resourceIds = uniqueResources
.map(row => row.id)
.map((row) => row.id)
.filter((id): id is number => id !== null);
const siteResourceIds = uniqueSiteResources
.map(row => row.id)
.map((row) => row.id)
.filter((id): id is number => id !== null);
let resourcesWithNames: Array<{ id: number; name: string | null }> = [];
@@ -353,7 +375,7 @@ async function queryUniqueFilterAttributes(
resourcesWithNames = [
...resourcesWithNames,
...resourceDetails.map(r => ({
...resourceDetails.map((r) => ({
id: r.resourceId,
name: r.name
}))
@@ -371,7 +393,7 @@ async function queryUniqueFilterAttributes(
resourcesWithNames = [
...resourcesWithNames,
...siteResourceDetails.map(r => ({
...siteResourceDetails.map((r) => ({
id: r.siteResourceId,
name: r.name
}))
server/routers/auth/lookupUser.ts
+41 -40
View File
@@ -1,14 +1,7 @@
import { Request, Response, NextFunction } from "express";
import { z } from "zod";
import { db } from "@server/db";
import {
users,
userOrgs,
orgs,
idpOrg,
idp,
idpOidcConfig
} from "@server/db";
import { users, userOrgs, orgs, idpOrg, idp, idpOidcConfig } from "@server/db";
import { eq, or, sql, and, isNotNull, inArray } from "drizzle-orm";
import response from "@server/lib/response";
import HttpCode from "@server/types/HttpCode";
@@ -57,7 +50,7 @@ export type LookupUserResponse = {
// content: {
// "application/json": {
// schema: z.object({
// data: z.unknown().nullable(),
// data: z.record(z.string(), z.any()).nullable(),
// success: z.boolean(),
// error: z.boolean(),
// message: z.string(),
@@ -169,46 +162,54 @@ export async function lookupUser(
);
// Deduplicate orgs (user might have multiple memberships in same org)
const uniqueOrgs = new Map<string, typeof userOrgMemberships[0]>();
const uniqueOrgs = new Map<
string,
(typeof userOrgMemberships)[0]
>();
for (const membership of userOrgMemberships) {
if (!uniqueOrgs.has(membership.orgId)) {
uniqueOrgs.set(membership.orgId, membership);
}
}
const orgsData = Array.from(uniqueOrgs.values()).map((membership) => {
// Get IdPs for this org where the user (with the exact identifier) is authenticated via that IdP
// Only show IdPs where the user's idpId matches
// Internal users don't have an idpId, so they won't see any IdPs
const orgIdpsList = orgIdps
.filter((idp) => {
if (idp.orgId !== membership.orgId) {
const orgsData = Array.from(uniqueOrgs.values()).map(
(membership) => {
// Get IdPs for this org where the user (with the exact identifier) is authenticated via that IdP
// Only show IdPs where the user's idpId matches
// Internal users don't have an idpId, so they won't see any IdPs
const orgIdpsList = orgIdps
.filter((idp) => {
if (idp.orgId !== membership.orgId) {
return false;
}
// Only show IdPs where the user (with exact identifier) is authenticated via that IdP
// This means user.idpId must match idp.idpId
if (
user.idpId !== null &&
user.idpId === idp.idpId
) {
return true;
}
return false;
}
// Only show IdPs where the user (with exact identifier) is authenticated via that IdP
// This means user.idpId must match idp.idpId
if (user.idpId !== null && user.idpId === idp.idpId) {
return true;
}
return false;
})
.map((idp) => ({
idpId: idp.idpId,
name: idp.idpName,
variant: idp.variant
}));
})
.map((idp) => ({
idpId: idp.idpId,
name: idp.idpName,
variant: idp.variant
}));
// Check if user has internal auth for this org
// User has internal auth if they have an internal account type
const orgHasInternalAuth = hasInternalAuth;
// Check if user has internal auth for this org
// User has internal auth if they have an internal account type
const orgHasInternalAuth = hasInternalAuth;
return {
orgId: membership.orgId,
orgName: membership.orgName,
idps: orgIdpsList,
hasInternalAuth: orgHasInternalAuth
};
});
return {
orgId: membership.orgId,
orgName: membership.orgName,
idps: orgIdpsList,
hasInternalAuth: orgHasInternalAuth
};
}
);
accounts.push({
userId: user.userId,
server/routers/badger/verifySession.ts
+3 -3
View File
@@ -145,9 +145,9 @@ export async function verifyResourceSession(
| ResourcePolicyHeaderAuth
| null;
headerAuthExtendedCompatibility: ResourceHeaderAuthExtendedCompatibility | null;
applyRules: boolean;
sso: boolean;
emailWhitelistEnabled: boolean;
applyRules: boolean | null;
sso: boolean | null;
emailWhitelistEnabled: boolean | null;
org: Org;
}
| undefined = localCache.get(resourceCacheKey);
server/routers/blueprints/applyJSONBlueprint.ts
+1 -1
View File
@@ -37,7 +37,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/blueprints/applyYAMLBlueprint.ts
+1 -1
View File
@@ -60,7 +60,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/blueprints/getBlueprint.ts
+1 -1
View File
@@ -62,7 +62,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/blueprints/listBlueprints.ts
+1 -1
View File
@@ -80,7 +80,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/client/archiveClient.ts
+1 -1
View File
@@ -28,7 +28,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/client/blockClient.ts
+6 -2
View File
@@ -30,7 +30,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
@@ -94,7 +94,11 @@ export async function blockClient(
// Send terminate signal if there's an associated OLM and it's connected
if (client.olmId && client.online) {
await sendTerminateClient(client.clientId, OlmErrorCodes.TERMINATED_BLOCKED, client.olmId);
await sendTerminateClient(
client.clientId,
OlmErrorCodes.TERMINATED_BLOCKED,
client.olmId
);
}
});
server/routers/client/createClient.ts
+1 -1
View File
@@ -65,7 +65,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/client/createUserClient.ts
+1 -1
View File
@@ -66,7 +66,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/client/deleteClient.ts
+1 -1
View File
@@ -31,7 +31,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/client/getClient.ts
+14 -14
View File
@@ -259,7 +259,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
@@ -287,7 +287,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
@@ -340,18 +340,18 @@ export async function getClient(
// Build fingerprint data if available
const fingerprintData = client.currentFingerprint
? {
username: client.currentFingerprint.username || null,
hostname: client.currentFingerprint.hostname || null,
platform: client.currentFingerprint.platform || null,
osVersion: client.currentFingerprint.osVersion || null,
kernelVersion:
client.currentFingerprint.kernelVersion || null,
arch: client.currentFingerprint.arch || null,
deviceModel: client.currentFingerprint.deviceModel || null,
serialNumber: client.currentFingerprint.serialNumber || null,
firstSeen: client.currentFingerprint.firstSeen || null,
lastSeen: client.currentFingerprint.lastSeen || null
}
username: client.currentFingerprint.username || null,
hostname: client.currentFingerprint.hostname || null,
platform: client.currentFingerprint.platform || null,
osVersion: client.currentFingerprint.osVersion || null,
kernelVersion:
client.currentFingerprint.kernelVersion || null,
arch: client.currentFingerprint.arch || null,
deviceModel: client.currentFingerprint.deviceModel || null,
serialNumber: client.currentFingerprint.serialNumber || null,
firstSeen: client.currentFingerprint.firstSeen || null,
lastSeen: client.currentFingerprint.lastSeen || null
}
: null;
// Build posture data if available (platform-specific)
server/routers/client/listClients.ts
+1 -1
View File
@@ -218,7 +218,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/client/listUserDevices.ts
+1 -1
View File
@@ -219,7 +219,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/client/targets.ts
+3 -3
View File
@@ -13,7 +13,7 @@ import semver from "semver";
const NEWT_V2_TARGETS_VERSION = ">=1.10.3";
export async function convertTargetsIfNessicary(
export async function convertTargetsIfNecessary(
newtId: string,
targets: SubnetProxyTarget[] | SubnetProxyTargetV2[]
) {
@@ -47,7 +47,7 @@ export async function addTargets(
targets: SubnetProxyTarget[] | SubnetProxyTargetV2[],
version?: string | null
) {
targets = await convertTargetsIfNessicary(newtId, targets);
targets = await convertTargetsIfNecessary(newtId, targets);
await sendToClient(
newtId,
@@ -64,7 +64,7 @@ export async function removeTargets(
targets: SubnetProxyTarget[] | SubnetProxyTargetV2[],
version?: string | null
) {
targets = await convertTargetsIfNessicary(newtId, targets);
targets = await convertTargetsIfNecessary(newtId, targets);
await sendToClient(
newtId,
server/routers/client/unarchiveClient.ts
+1 -1
View File
@@ -28,7 +28,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/client/unblockClient.ts
+1 -1
View File
@@ -28,7 +28,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/client/updateClient.ts
+1 -1
View File
@@ -42,7 +42,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/domain/getDNSRecords.ts
+1 -1
View File
@@ -43,7 +43,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/domain/getDomain.ts
+1 -1
View File
@@ -44,7 +44,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/idp/deleteIdp.ts
+1 -1
View File
@@ -31,7 +31,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/idp/deleteIdpOrgPolicy.ts
+1 -1
View File
@@ -29,7 +29,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/idp/getIdp.ts
+1 -1
View File
@@ -44,7 +44,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/idp/validateOidcCallback.ts
+2 -4
View File
@@ -1,6 +1,6 @@
import { Request, Response, NextFunction } from "express";
import { z } from "zod";
import { db, Org } from "@server/db";
import { db, Org, primaryDb } from "@server/db";
import response from "@server/lib/response";
import HttpCode from "@server/types/HttpCode";
import createHttpError from "http-errors";
@@ -635,9 +635,7 @@ export async function validateOidcCallback(
}
});
db.transaction(async (trx) => {
await calculateUserClientsForOrgs(userId!, trx);
}).catch((err) => {
calculateUserClientsForOrgs(userId!, primaryDb).catch((err) => {
logger.error(
"Error calculating user clients after syncing orgs and roles for OIDC user",
{ error: err }
server/routers/newt/buildConfiguration.ts
+55 -25
View File
@@ -152,34 +152,64 @@ export async function buildClientConfigurationForNewtClient(
const targetsToSend: SubnetProxyTargetV2[] = [];
for (const resource of allSiteResources) {
// Get clients associated with this specific resource
const resourceClients = await db
.select({
clientId: clients.clientId,
pubKey: clients.pubKey,
subnet: clients.subnet
})
.from(clients)
.innerJoin(
clientSiteResourcesAssociationsCache,
eq(
clients.clientId,
clientSiteResourcesAssociationsCache.clientId
)
)
.where(
eq(
clientSiteResourcesAssociationsCache.siteResourceId,
resource.siteResourceId
)
);
if (allSiteResources.length === 0) {
return {
peers: validPeers,
targets: targetsToSend
};
}
const resourceTargets = await generateSubnetProxyTargetV2(
resource,
resourceClients
// Batch fetch all client associations for every site resource in one query
// to avoid an N+1 lookup that would issue thousands of queries when a site
// has many resources.
const siteResourceIds = allSiteResources.map((r) => r.siteResourceId);
const resourceClientRows = await db
.select({
siteResourceId: clientSiteResourcesAssociationsCache.siteResourceId,
clientId: clients.clientId,
pubKey: clients.pubKey,
subnet: clients.subnet
})
.from(clients)
.innerJoin(
clientSiteResourcesAssociationsCache,
eq(clients.clientId, clientSiteResourcesAssociationsCache.clientId)
)
.where(
inArray(
clientSiteResourcesAssociationsCache.siteResourceId,
siteResourceIds
)
);
const clientsByResourceId = new Map<
number,
{ clientId: number; pubKey: string | null; subnet: string | null }[]
>();
for (const row of resourceClientRows) {
let list = clientsByResourceId.get(row.siteResourceId);
if (!list) {
list = [];
clientsByResourceId.set(row.siteResourceId, list);
}
list.push({
clientId: row.clientId,
pubKey: row.pubKey,
subnet: row.subnet
});
}
const resourceTargetsArr = await Promise.all(
allSiteResources.map((resource) =>
generateSubnetProxyTargetV2(
resource,
clientsByResourceId.get(resource.siteResourceId) ?? []
)
)
);
for (const resourceTargets of resourceTargetsArr) {
if (resourceTargets) {
targetsToSend.push(...resourceTargets);
}
server/routers/newt/getNewtVersion.ts
+7 -2
View File
@@ -56,13 +56,18 @@ async function getLatestReleaseInfo(): Promise<ReleaseInfo | null> {
return staleReleaseInfo;
}
// Drop drafts, pre-releases, and anything with "rc" in the tag name.
const oneDayAgo = new Date(Date.now() - 24 * 60 * 60 * 1000);
// Drop drafts, pre-releases, anything with "rc" in the tag name,
// and releases published less than 1 day ago.
releases = releases.filter(
(r: any) =>
!r.draft &&
!r.prerelease &&
!r.tag_name.includes("rc") &&
!r.tag_name.includes("v")
!r.tag_name.includes("v") &&
r.published_at &&
new Date(r.published_at) <= oneDayAgo
);
// Sort descending by semver to find the true latest stable release.
server/routers/newt/handleNewtGetConfigMessage.ts
+2 -2
View File
@@ -6,7 +6,7 @@ import { db, ExitNode, exitNodes, Newt, sites } from "@server/db";
import { eq } from "drizzle-orm";
import { sendToExitNode } from "#dynamic/lib/exitNodes";
import { buildClientConfigurationForNewtClient } from "./buildConfiguration";
import { convertTargetsIfNessicary } from "../client/targets";
import { convertTargetsIfNecessary } from "../client/targets";
import { canCompress } from "@server/lib/clientVersionChecks";
import config from "@server/lib/config";
@@ -113,7 +113,7 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
exitNode
);
const targetsToSend = await convertTargetsIfNessicary(newt.newtId, targets); // for backward compatibility with old newt versions that don't support the new target format
const targetsToSend = await convertTargetsIfNecessary(newt.newtId, targets); // for backward compatibility with old newt versions that don't support the new target format
return {
message: {
server/routers/olm/createUserOlm.ts
+1 -1
View File
@@ -49,7 +49,7 @@ export type CreateOlmResponse = {
// content: {
// "application/json": {
// schema: z.object({
// data: z.unknown().nullable(),
// data: z.record(z.string(), z.any()).nullable(),
// success: z.boolean(),
// error: z.boolean(),
// message: z.string(),
server/routers/olm/deleteUserOlm.ts
+1 -1
View File
@@ -34,7 +34,7 @@ const paramsSchema = z
// content: {
// "application/json": {
// schema: z.object({
// data: z.unknown().nullable(),
// data: z.record(z.string(), z.any()).nullable(),
// success: z.boolean(),
// error: z.boolean(),
// message: z.string(),
server/routers/olm/getUserOlm.ts
+1 -1
View File
@@ -36,7 +36,7 @@ const querySchema = z.object({
// content: {
// "application/json": {
// schema: z.object({
// data: z.unknown().nullable(),
// data: z.record(z.string(), z.any()).nullable(),
// success: z.boolean(),
// error: z.boolean(),
// message: z.string(),
server/routers/olm/listUserOlms.ts
+1 -1
View File
@@ -47,7 +47,7 @@ const paramsSchema = z
// content: {
// "application/json": {
// schema: z.object({
// data: z.unknown().nullable(),
// data: z.record(z.string(), z.any()).nullable(),
// success: z.boolean(),
// error: z.boolean(),
// message: z.string(),
server/routers/org/checkOrgUserAccess.ts
+2 -5
View File
@@ -49,10 +49,7 @@ async function queryUser(orgId: string, userId: string) {
.from(userOrgRoles)
.leftJoin(roles, eq(userOrgRoles.roleId, roles.roleId))
.where(
and(
eq(userOrgRoles.userId, userId),
eq(userOrgRoles.orgId, orgId)
)
and(eq(userOrgRoles.userId, userId), eq(userOrgRoles.orgId, orgId))
);
const isAdmin = roleRows.some((r) => r.isAdmin);
@@ -89,7 +86,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/org/createOrg.ts
+1 -1
View File
@@ -80,7 +80,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/org/deleteOrg.ts
+1 -1
View File
@@ -30,7 +30,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/org/listUserOrgs.ts
+1 -1
View File
@@ -43,7 +43,7 @@ const listOrgsSchema = z.object({
// content: {
// "application/json": {
// schema: z.object({
// data: z.unknown().nullable(),
// data: z.record(z.string(), z.any()).nullable(),
// success: z.boolean(),
// error: z.boolean(),
// message: z.string(),
server/routers/org/resetOrgBandwidth.ts
+1 -1
View File
@@ -27,7 +27,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/org/updateOrg.ts
+1 -1
View File
@@ -68,7 +68,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/resource/addEmailToResourceWhitelist.ts
+1 -1
View File
@@ -46,7 +46,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/resource/addRoleToResource.ts
+3 -2
View File
@@ -28,7 +28,8 @@ const addRoleToResourceParamsSchema = z
registry.registerPath({
method: "post",
path: "/resource/{resourceId}/roles/add",
description: "Add a single role to a resource.",
description:
"Add a single role to a resource. When the resource has an inline policy defined (no shared resource policy assigned), the role is added to the inline policy instead of directly to the resource.",
tags: [OpenAPITags.PublicResource, OpenAPITags.Role],
request: {
params: addRoleToResourceParamsSchema,
@@ -46,7 +47,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/resource/addUserToResource.ts
+3 -2
View File
@@ -28,7 +28,8 @@ const addUserToResourceParamsSchema = z
registry.registerPath({
method: "post",
path: "/resource/{resourceId}/users/add",
description: "Add a single user to a resource.",
description:
"Add a single user to a resource. When the resource has an inline policy defined (no shared resource policy assigned), the user is added to the inline policy instead of directly to the resource.",
tags: [OpenAPITags.PublicResource, OpenAPITags.User],
request: {
params: addUserToResourceParamsSchema,
@@ -46,7 +47,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/resource/createResource.ts
+1 -1
View File
@@ -168,7 +168,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/resource/createResourceRule.ts
+1 -1
View File
@@ -49,7 +49,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/resource/deleteResource.ts
+1 -1
View File
@@ -37,7 +37,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/resource/deleteResourceRule.ts
+1 -1
View File
@@ -29,7 +29,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/resource/getResource.ts
+35 -7
View File
@@ -1,4 +1,4 @@
import { db, resources } from "@server/db";
import { db, resourcePolicies, resources } from "@server/db";
import response from "@server/lib/response";
import stoi from "@server/lib/stoi";
import logger from "@server/logger";
@@ -41,6 +41,15 @@ async function query(resourceId?: number, niceId?: string, orgId?: string) {
}
}
async function queryInlinePolicy(resourcePolicyId: number) {
const [res] = await db
.select()
.from(resourcePolicies)
.where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId))
.limit(1);
return res;
}
export type GetResourceResponse = Omit<
NonNullable<Awaited<ReturnType<typeof query>>>,
"headers"
@@ -66,7 +75,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
@@ -94,7 +103,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
@@ -132,12 +141,31 @@ export async function getResource(
);
}
const isInlinePolicy =
resource.resourcePolicyId === null &&
resource.defaultResourcePolicyId !== null;
let returnData = resource;
if (isInlinePolicy) {
// get the policy
const policy = await queryInlinePolicy(
resource.defaultResourcePolicyId!
);
returnData = {
...returnData,
sso: policy?.sso || null,
emailWhitelistEnabled: policy?.emailWhitelistEnabled || null,
applyRules: policy?.applyRules || null,
skipToIdpId: policy?.idpId || null
};
}
return response<GetResourceResponse>(res, {
data: {
...resource,
headers: resource.headers
? JSON.parse(resource.headers)
: resource.headers
...returnData,
headers: returnData.headers
? JSON.parse(returnData.headers)
: returnData.headers
},
success: true,
error: false,
server/routers/resource/getResourceWhitelist.ts
+1 -1
View File
@@ -54,7 +54,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/resource/getUserResources.ts
+2 -2
View File
@@ -203,9 +203,9 @@ export async function getUserResources(
fullDomain: string | null;
ssl: boolean;
enabled: boolean;
sso: boolean;
sso: boolean | null;
mode: string;
emailWhitelistEnabled: boolean;
emailWhitelistEnabled: boolean | null;
policyEmailWhitelistEnabled: boolean | null;
}> = [];
if (uniqueResourceIds.length > 0) {
server/routers/resource/listAllResourceNames.ts
+1 -1
View File
@@ -45,7 +45,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/resource/listResourceRoles.ts
+1 -1
View File
@@ -58,7 +58,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/resource/listResourceRules.ts
+1 -1
View File
@@ -82,7 +82,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/resource/listResourceUsers.ts
+1 -1
View File
@@ -48,7 +48,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
server/routers/resource/listResources.ts
+34 -1
View File
@@ -123,6 +123,16 @@ const listResourcesSchema = z.object({
description:
"Filter resources based on health status of their targets. `healthy` means all targets are healthy. `degraded` means at least one target is unhealthy, but not all are unhealthy. `offline` means all targets are unhealthy. `unknown` means all targets have unknown health status."
}),
protocol: z
.enum(["http", "https", "tcp", "udp", "ssh", "rdp", "vnc"])
.optional()
.catch(undefined)
.openapi({
type: "string",
enum: ["http", "https", "tcp", "udp", "ssh", "rdp", "vnc"],
description:
"Filter resources by protocol. `http` and `https` match HTTP resources without and with SSL respectively."
}),
siteId: z.coerce.number<string>().int().positive().optional().openapi({
type: "integer",
description:
@@ -403,7 +413,7 @@ registry.registerPath({
content: {
"application/json": {
schema: z.object({
data: z.unknown().nullable(),
data: z.record(z.string(), z.any()).nullable(),
success: z.boolean(),
error: z.boolean(),
message: z.string(),
@@ -437,6 +447,7 @@ export async function listResources(
enabled,
query,
healthStatus,
protocol,
sort_by,
order,
siteId,
@@ -632,6 +643,28 @@ export async function listResources(
if (typeof healthStatus !== "undefined") {
conditions.push(eq(resources.health, healthStatus));
}
if (typeof protocol !== "undefined") {
switch (protocol) {
case "http":
conditions.push(
and(
eq(resources.mode, "http"),
eq(resources.ssl, false)
)
);
break;
case "https":
conditions.push(
and(eq(resources.mode, "http"), eq(resources.ssl, true))
);
break;
default:
conditions.push(eq(resources.mode, protocol));
break;
}
}
if (siteId != null) {
const resourcesWithSite = db
.select({ resourceId: targets.resourceId })
server/routers/resource/listUserResourceAliases.ts
+3 -3
View File
@@ -7,7 +7,7 @@ import {
userOrgRoles,
userOrgs
} from "@server/db";
import { and, eq, inArray, asc, isNotNull, ne } from "drizzle-orm";
import { and, eq, inArray, asc, isNotNull, ne, or } from "drizzle-orm";
import createHttpError from "http-errors";
import HttpCode from "@server/types/HttpCode";
import response from "@server/lib/response";
@@ -82,7 +82,7 @@ export type ListUserResourceAliasesResponse = PaginatedResponse<{
// content: {
// "application/json": {
// schema: z.object({
// data: z.unknown().nullable(),
// data: z.record(z.string(), z.any()).nullable(),
// success: z.boolean(),
// error: z.boolean(),
// message: z.string(),
@@ -224,7 +224,7 @@ export async function listUserResourceAliases(
const whereClause = and(
eq(siteResources.orgId, orgId),
eq(siteResources.enabled, true),
eq(siteResources.mode, "host"),
or(eq(siteResources.mode, "host"), eq(siteResources.mode, "ssh")),
isNotNull(siteResources.alias),
ne(siteResources.alias, ""),
inArray(siteResources.siteResourceId, accessibleSiteResourceIds)

Some files were not shown because too many files have changed in this diff Show More