gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-11 11:16:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(nodes): never send stored node tokens to clients (#1281)

Browse Source 
Node read endpoints now return a client-safe projection that omits the
stored api_token and exposes a has_token boolean instead, so a node's
long-lived proxy credential is never serialized to a browser or API
token client. The token stays encrypted at rest and is read server-side
only by the components that need it (the remote proxy, the connection
test, and the mesh dialer).

The edit form opens the API Token field blank, and a blank value keeps
the existing credential, so saving an edit without retyping the token no
longer clears it; a non-empty value rotates it. The backend enforces the
same rule defensively.

Node management actions (add, edit, delete, test connection, generate
node token) are gated in the UI to match their server-side permission
checks, so operators no longer see an action the API would reject. The
test-connection route also gains the missing server-side permission and
token-scope guards.

Also validate the x-node-id header and fall back to the default node for
malformed values instead of an obscure 404, and return 400 (not 500)
when deleting the default node.
This commit is contained in:
Anso
2026-06-02 10:26:31 -04:00
committed by GitHub
parent 35a1182890
commit 65a69d9ecc
9 changed files with 273 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/middleware/nodeContext.ts
+19 -7
View File
@@ -2,6 +2,7 @@ import type { Request, Response, NextFunction, RequestHandler } from 'express';
import { NodeRegistry } from '../services/NodeRegistry';
import { DatabaseService } from '../services/DatabaseService';
import { isProxyExemptPath } from '../helpers/proxyExemptPaths';
import { sanitizeForLog } from '../utils/safeLog';
/**
* Resolve `req.nodeId` from the `x-node-id` header, `?nodeId=` query param,
@@ -15,13 +16,24 @@ import { isProxyExemptPath } from '../helpers/proxyExemptPaths';
export const nodeContextMiddleware: RequestHandler = (req: Request, res: Response, next: NextFunction) => {
const nodeIdHeader = req.headers['x-node-id'] as string;
const nodeIdQuery = req.query.nodeId as string;
if (nodeIdHeader) {
req.nodeId = parseInt(nodeIdHeader, 10);
} else if (nodeIdQuery) {
req.nodeId = parseInt(nodeIdQuery, 10);
} else {
req.nodeId = NodeRegistry.getInstance().getDefaultNodeId();
}
// A malformed id (parseInt → NaN, or a non-positive value) must fall back to
// the default node rather than resolve to NaN and trip the obscure 404 below.
// A well-formed id for a node that does not exist still 404s further down;
// only malformed input falls through to the default.
const parseNodeId = (raw: string | undefined): number | null => {
if (!raw) return null;
const n = parseInt(raw, 10);
if (Number.isInteger(n) && n > 0) return n;
// Present but malformed is a client bug: warn so the fall-back to the
// default node is observable instead of a request silently landing on the
// wrong node during debugging.
console.warn(`[NodeContext] Ignoring malformed node id "${sanitizeForLog(raw)}"; using the default node.`);
return null;
};
req.nodeId =
parseNodeId(nodeIdHeader) ??
parseNodeId(nodeIdQuery) ??
NodeRegistry.getInstance().getDefaultNodeId();
if (req.path.startsWith('/api/') && !isProxyExemptPath(req.path)) {
const node = DatabaseService.getInstance().getNode(req.nodeId);