denozord/technitium-console
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Hub stage 0: own users with roles, login limit, audit log, permission table

Browse Source 
Users in HUB_DATA/users.json with scrypt hashes and roles (viewer, operator,
apps-admin, admin), managed by hub/users-cli.ts; HUB_USER/HUB_PASSWORD remain a
bootstrap admin while the file does not exist. Five failed logins in 15 minutes lock
the address or the name for 15 minutes. Logins, logouts and every refused request go
to a JSON Lines audit log that admins read through hub/audit/list. Endpoints are
listed in routes.ts with their kind and capability; writes stay refused for now.
Optional <ID>_ADMIN_TOKEN is read for the coming write stages. The management plan
is in docs/hub-management-plan.md.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
DenozordecandClaude Opus 5.5 committed 2026-10-31 15:25:38 +07:00
1 parent 042cb116ea
commit 0ef2d53a65
17 files changed
+1497 -79
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

hub/server.test.ts
+6 -2
View File
@@ -77,6 +77,7 @@ let b: Fake
let hub: http.Server
let base: string
let staticDir: string
let dataDir: string
function makeConfig(over: Record<string, string> = {}) {
return parseConfig({
@@ -86,6 +87,7 @@ function makeConfig(over: Record<string, string> = {}) {
HUB_USER: 'admin',
HUB_PASSWORD: 'secret',
HUB_STATIC: staticDir,
HUB_DATA: dataDir,
HUB_CACHE_SECONDS: '15',
HUB_TIMEOUT_MS: '2000',
...over,
@@ -117,6 +119,7 @@ async function login(): Promise<string> {
beforeAll(async () => {
a = await fakeUpstream(canned(100, ['2026-01-01T10:00:04Z', '2026-01-01T10:00:02Z']))
b = await fakeUpstream(canned(300, ['2026-01-01T10:00:03Z', '2026-01-01T10:00:01Z']))
dataDir = mkdtempSync(path.join(tmpdir(), 'hub-data-'))
staticDir = mkdtempSync(path.join(tmpdir(), 'hub-static-'))
writeFileSync(path.join(staticDir, 'index.html'), '<html>root</html>')
mkdirSync(path.join(staticDir, 'logs', 'query-logs'), { recursive: true })
@@ -129,6 +132,7 @@ afterAll(() => {
a.server.close()
b.server.close()
rmSync(staticDir, { recursive: true, force: true })
rmSync(dataDir, { recursive: true, force: true })
})
beforeEach(async () => {
@@ -142,9 +146,9 @@ beforeEach(async () => {
})
describe('config', () => {
it('refuses to start without credentials or a token', () => {
it('refuses to start with half the credentials or without a token', () => {
const env = { HUB_SERVERS: 'a=http://x', A_TOKEN: 't' }
expect(() => parseConfig(env)).toThrow(/HUB_USER/)
expect(() => parseConfig({ ...env, HUB_USER: 'u' })).toThrow(/HUB_USER/)
expect(() => parseConfig({ ...env, HUB_USER: 'u', HUB_PASSWORD: 'p', A_TOKEN: '' })).toThrow(/A_TOKEN/)
})