380 lines
18 KiB
JavaScript
380 lines
18 KiB
JavaScript
import { pool } from '../db.js'
|
|
import { encrypt, decrypt } from '../crypto.js'
|
|
import { requireAdmin } from '../auth.js'
|
|
import { INTEGRATIONS, MASKED } from '../integrations/schema.js'
|
|
import { testConnection as newbookTest, fetchSiteList } from '../integrations/newbook.js'
|
|
import { testConnection as resosTest } from '../integrations/resos.js'
|
|
|
|
const AUTH_URL = process.env.AUTH_URL || 'http://10.10.10.101:3001'
|
|
|
|
function bustAuthCache() {
|
|
const secret = process.env.SETTINGS_SECRET || ''
|
|
fetch(`${AUTH_URL}/api/auth/internal/cache-bust`, {
|
|
method: 'POST',
|
|
headers: { Authorization: `Bearer ${secret}` },
|
|
signal: AbortSignal.timeout(3000),
|
|
}).catch(() => {})
|
|
}
|
|
|
|
function decryptSecrets(row) {
|
|
if (!row.secrets) return {}
|
|
try { return JSON.parse(decrypt(row.secrets)) } catch { return {} }
|
|
}
|
|
|
|
function maskRow(row) {
|
|
const schema = INTEGRATIONS[row.slug]
|
|
// Always return all schema-defined config fields, even if not yet saved
|
|
const config = {}
|
|
for (const f of schema?.configFields ?? []) {
|
|
config[f] = row.config?.[f] ?? ''
|
|
}
|
|
const existing = decryptSecrets(row)
|
|
const masked = {}
|
|
for (const f of schema?.secretFields ?? []) {
|
|
masked[f] = existing[f] ? MASKED : null
|
|
}
|
|
return { slug: row.slug, name: row.name, config, secrets: masked, enabled: row.enabled, updated_at: row.updated_at }
|
|
}
|
|
|
|
export async function integrationRoutes(app) {
|
|
// GET /settings/api/integrations
|
|
app.get('/integrations', { preHandler: requireAdmin }, async () => {
|
|
const { rows } = await pool.query('SELECT * FROM integrations ORDER BY slug')
|
|
return rows.map(maskRow)
|
|
})
|
|
|
|
// GET /settings/api/integrations/:slug
|
|
app.get('/integrations/:slug', { preHandler: requireAdmin }, async (req, reply) => {
|
|
const { rows: [row] } = await pool.query('SELECT * FROM integrations WHERE slug = $1', [req.params.slug])
|
|
if (!row) return reply.status(404).send({ error: 'Not found' })
|
|
return maskRow(row)
|
|
})
|
|
|
|
// PUT /settings/api/integrations/:slug
|
|
app.put('/integrations/:slug', { preHandler: requireAdmin }, async (req, reply) => {
|
|
const { slug } = req.params
|
|
const schema = INTEGRATIONS[slug]
|
|
if (!schema) return reply.status(404).send({ error: 'Unknown integration' })
|
|
|
|
const body = req.body || {}
|
|
|
|
// Build config (plaintext fields)
|
|
const config = {}
|
|
for (const f of schema.configFields) {
|
|
if (body[f] !== undefined) config[f] = body[f]
|
|
}
|
|
|
|
// Merge secrets — skip masked sentinel values so we don't overwrite with garbage
|
|
const { rows: [existing] } = await pool.query('SELECT secrets FROM integrations WHERE slug = $1', [slug])
|
|
const prev = existing ? decryptSecrets(existing) : {}
|
|
const next = { ...prev }
|
|
for (const f of schema.secretFields) {
|
|
if (body[f] !== undefined && body[f] !== MASKED && body[f] !== '') {
|
|
next[f] = body[f]
|
|
}
|
|
}
|
|
const secretsEnc = Object.keys(next).length ? encrypt(JSON.stringify(next)) : null
|
|
const enabled = body.enabled !== undefined ? Boolean(body.enabled) : true
|
|
|
|
await pool.query(`
|
|
INSERT INTO integrations (slug, name, config, secrets, enabled, updated_at)
|
|
VALUES ($1, $2, $3, $4, $5, NOW())
|
|
ON CONFLICT (slug) DO UPDATE SET
|
|
config = EXCLUDED.config,
|
|
secrets = EXCLUDED.secrets,
|
|
enabled = EXCLUDED.enabled,
|
|
updated_at = NOW()
|
|
`, [slug, schema.name, config, secretsEnc, enabled])
|
|
|
|
const { rows: [updated] } = await pool.query('SELECT * FROM integrations WHERE slug = $1', [slug])
|
|
|
|
if (slug === 'workforce' || slug === 'smtp') bustAuthCache()
|
|
|
|
return maskRow(updated)
|
|
})
|
|
|
|
// POST /settings/api/integrations/:slug/test
|
|
app.post('/integrations/:slug/test', { preHandler: requireAdmin }, async (req, reply) => {
|
|
const { rows: [row] } = await pool.query('SELECT * FROM integrations WHERE slug = $1', [req.params.slug])
|
|
if (!row) return reply.status(404).send({ error: 'Not found' })
|
|
const creds = { ...row.config, ...decryptSecrets(row) }
|
|
try {
|
|
if (req.params.slug === 'newbook') await newbookTest(creds)
|
|
else if (req.params.slug === 'resos') await resosTest(creds)
|
|
else if (req.params.slug === 'workforce') {
|
|
if (!creds.bearer_token) throw new Error('Workforce bearer token not configured')
|
|
const baseUrl = creds.base_url || 'https://my.workforce.com'
|
|
const res = await fetch(`${baseUrl}/api/v2/users/me`, {
|
|
headers: { Authorization: `Bearer ${creds.bearer_token}` },
|
|
signal: AbortSignal.timeout(8000),
|
|
})
|
|
if (!res.ok) throw new Error(`Workforce bearer token invalid (${res.status})`)
|
|
}
|
|
else if (req.params.slug === 'smtp') {
|
|
const nodemailer = await import('nodemailer')
|
|
const transporter = nodemailer.default.createTransport({
|
|
host: creds.host, port: parseInt(creds.port || '587'),
|
|
auth: { user: creds.user, pass: creds.pass },
|
|
})
|
|
await transporter.verify()
|
|
}
|
|
else if (req.params.slug === 'nextcloud') {
|
|
if (!creds.base_url || !creds.username || !creds.password) throw new Error('Nextcloud base URL, username and password are required')
|
|
const url = `${creds.base_url.replace(/\/$/, '')}/remote.php/dav/files/${encodeURIComponent(creds.username)}/`
|
|
const res = await fetch(url, {
|
|
method: 'PROPFIND',
|
|
headers: { Authorization: `Basic ${Buffer.from(`${creds.username}:${creds.password}`).toString('base64')}`, Depth: '0' },
|
|
signal: AbortSignal.timeout(8000),
|
|
})
|
|
if (res.status === 401) throw new Error('Invalid Nextcloud credentials')
|
|
if (!res.ok) throw new Error(`Nextcloud returned ${res.status}`)
|
|
}
|
|
else if (req.params.slug === 'azure') {
|
|
if (!creds.endpoint || !creds.api_key) throw new Error('Azure endpoint and API key are required')
|
|
const base = creds.endpoint.replace(/\/$/, '')
|
|
const res = await fetch(`${base}/documentintelligence/info?api-version=2024-11-30`, {
|
|
headers: { 'Ocp-Apim-Subscription-Key': creds.api_key },
|
|
signal: AbortSignal.timeout(8000),
|
|
})
|
|
if (res.status === 401 || res.status === 403) throw new Error('Invalid Azure API key')
|
|
if (!res.ok) throw new Error(`Azure returned ${res.status}`)
|
|
}
|
|
else if (req.params.slug === 'sambapos') {
|
|
const errors = []
|
|
// SQL test
|
|
try {
|
|
if (!creds.sql_host || !creds.sql_database || !creds.sql_username || !creds.sql_password)
|
|
throw new Error('SQL host, database, username and password are required')
|
|
const { default: pg } = await import('pg')
|
|
const sqlPool = new pg.Pool({
|
|
host: creds.sql_host, port: parseInt(creds.sql_port || '5432'),
|
|
database: creds.sql_database, user: creds.sql_username, password: creds.sql_password,
|
|
connectionTimeoutMillis: 8000, max: 1,
|
|
})
|
|
await sqlPool.query('SELECT 1')
|
|
await sqlPool.end()
|
|
} catch (e) { errors.push(`SQL: ${e.message}`) }
|
|
// GraphQL test — obtain token via password grant then run a minimal query
|
|
try {
|
|
if (!creds.graphql_endpoint || !creds.graphql_username || !creds.graphql_password || !creds.graphql_client_id)
|
|
throw new Error('GraphQL endpoint, username, password and client ID are required')
|
|
const base = creds.graphql_endpoint.replace(/\/$/, '')
|
|
const tokenRes = await fetch(`${base}/connect/token`, {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
|
|
body: new URLSearchParams({
|
|
grant_type: 'password',
|
|
username: creds.graphql_username,
|
|
password: creds.graphql_password,
|
|
client_id: creds.graphql_client_id,
|
|
scope: 'api',
|
|
}),
|
|
signal: AbortSignal.timeout(8000),
|
|
})
|
|
if (!tokenRes.ok) throw new Error(`Token request failed (${tokenRes.status})`)
|
|
const { access_token } = await tokenRes.json()
|
|
if (!access_token) throw new Error('No access token returned')
|
|
const gqlRes = await fetch(`${base}/api`, {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${access_token}` },
|
|
body: JSON.stringify({ query: '{ __typename }' }),
|
|
signal: AbortSignal.timeout(8000),
|
|
})
|
|
if (!gqlRes.ok) throw new Error(`GraphQL request failed (${gqlRes.status})`)
|
|
} catch (e) { errors.push(`GraphQL: ${e.message}`) }
|
|
if (errors.length) throw new Error(errors.join(' | '))
|
|
}
|
|
else return reply.status(400).send({ error: `No test available for ${req.params.slug}` })
|
|
return { ok: true }
|
|
} catch (e) {
|
|
return { ok: false, error: e.message }
|
|
}
|
|
})
|
|
|
|
// POST /settings/api/integrations/newbook/sync-rooms
|
|
// GET /settings/api/integrations/workforce/locations — derive locations from teams list
|
|
app.get('/integrations/workforce/locations', { preHandler: requireAdmin }, async (req, reply) => {
|
|
const { rows: [row] } = await pool.query(`SELECT * FROM integrations WHERE slug = 'workforce'`)
|
|
if (!row?.enabled) return reply.status(400).send({ error: 'Workforce integration not enabled' })
|
|
const creds = { ...row.config, ...decryptSecrets(row) }
|
|
if (!creds.bearer_token) return reply.status(400).send({ error: 'Workforce bearer token not configured' })
|
|
const baseUrl = creds.base_url || 'https://my.workforce.com'
|
|
|
|
// /api/v2/locations list may be billing-locked — get unique IDs from teams then fetch each individually
|
|
const teams = []
|
|
let page = 1
|
|
while (true) {
|
|
const res = await fetch(`${baseUrl}/api/v2/departments?page=${page}&page_size=100`, {
|
|
headers: { Authorization: `Bearer ${creds.bearer_token}` },
|
|
signal: AbortSignal.timeout(8000),
|
|
})
|
|
if (!res.ok) {
|
|
const body = await res.text().catch(() => '')
|
|
const msg = (() => { try { return JSON.parse(body).error } catch { return body.slice(0, 200) } })()
|
|
return reply.status(502).send({ error: msg || `Workforce API error (${res.status})` })
|
|
}
|
|
const data = await res.json()
|
|
const items = Array.isArray(data) ? data : (data.departments ?? [])
|
|
teams.push(...items)
|
|
if (items.length < 100) break
|
|
page++
|
|
}
|
|
|
|
const locationIds = [...new Set(teams.map(t => t.location_id).filter(Boolean).map(String))]
|
|
|
|
// Fetch each location individually in parallel
|
|
const locations = await Promise.all(locationIds.map(async id => {
|
|
try {
|
|
const res = await fetch(`${baseUrl}/api/v2/locations/${id}`, {
|
|
headers: { Authorization: `Bearer ${creds.bearer_token}` },
|
|
signal: AbortSignal.timeout(8000),
|
|
})
|
|
if (!res.ok) return { id, name: `Location ${id}`, short_name: null }
|
|
const loc = await res.json()
|
|
return { id, name: loc.name ?? `Location ${id}`, short_name: loc.short_name ?? null }
|
|
} catch {
|
|
return { id, name: `Location ${id}`, short_name: null }
|
|
}
|
|
}))
|
|
|
|
return locations.sort((a, b) => a.name.localeCompare(b.name))
|
|
})
|
|
|
|
app.post('/integrations/newbook/sync-rooms', { preHandler: requireAdmin }, async (req, reply) => {
|
|
const { rows: [row] } = await pool.query(`SELECT * FROM integrations WHERE slug = 'newbook'`)
|
|
if (!row?.enabled) return reply.status(400).send({ error: 'Newbook integration not enabled' })
|
|
const creds = { ...row.config, ...decryptSecrets(row) }
|
|
if (!creds.api_key) return reply.status(400).send({ error: 'Newbook credentials not configured' })
|
|
|
|
let raw
|
|
try { raw = await fetchSiteList(creds) }
|
|
catch (e) { return reply.status(502).send({ error: e.message }) }
|
|
|
|
// Normalise: site_list returns array with category_id, category_name, site_id, site_name
|
|
const items = Array.isArray(raw) ? raw : (raw?.data ?? [])
|
|
const catMap = {}
|
|
const sites = []
|
|
for (const item of items) {
|
|
const cid = String(item.category_id)
|
|
if (!catMap[cid]) {
|
|
catMap[cid] = { id: cid, name: item.category_name, sort_order: Object.keys(catMap).length, colour: null }
|
|
}
|
|
if (item.site_id) {
|
|
sites.push({ id: String(item.site_id), name: item.site_name, category_id: cid })
|
|
}
|
|
}
|
|
|
|
// Preserve existing sort_order and colour customisations
|
|
const { rows: [prev] } = await pool.query(`SELECT value FROM global_config WHERE key = 'newbook.rooms'`)
|
|
const prevCats = {}
|
|
for (const c of prev?.value?.categories ?? []) prevCats[c.id] = c
|
|
|
|
const categories = Object.values(catMap).map(c => ({
|
|
...c,
|
|
sort_order: prevCats[c.id]?.sort_order ?? c.sort_order,
|
|
colour: prevCats[c.id]?.colour ?? null,
|
|
})).sort((a, b) => a.sort_order - b.sort_order)
|
|
|
|
const value = { categories, sites, synced_at: new Date().toISOString() }
|
|
await pool.query(`
|
|
INSERT INTO global_config (key, value, updated_at) VALUES ('newbook.rooms', $1, NOW())
|
|
ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = NOW()
|
|
`, [value])
|
|
|
|
return value
|
|
})
|
|
|
|
// GET /settings/api/internal/global-config/:key — service-to-service read of global_config
|
|
// Authenticated by SETTINGS_SECRET bearer token; returns the value JSON for the given key.
|
|
app.get('/internal/global-config/:key', async (req, reply) => {
|
|
const token = (req.headers.authorization || '').replace(/^Bearer\s+/i, '')
|
|
if (!token || token !== process.env.SETTINGS_SECRET) {
|
|
return reply.status(401).send({ error: 'Unauthorized' })
|
|
}
|
|
const { rows: [row] } = await pool.query('SELECT value FROM global_config WHERE key = $1', [req.params.key])
|
|
if (!row) return reply.status(404).send({ error: 'Not found' })
|
|
return { value: row.value }
|
|
})
|
|
|
|
// GET /settings/api/internal/integration/:slug — service-to-service, no user session required
|
|
// Authenticated by SETTINGS_SECRET bearer token; returns unmasked credentials.
|
|
app.get('/internal/integration/:slug', async (req, reply) => {
|
|
const token = (req.headers.authorization || '').replace(/^Bearer\s+/i, '')
|
|
if (!token || token !== process.env.SETTINGS_SECRET) {
|
|
return reply.status(401).send({ error: 'Unauthorized' })
|
|
}
|
|
const { rows: [row] } = await pool.query('SELECT * FROM integrations WHERE slug = $1', [req.params.slug])
|
|
if (!row) return reply.status(404).send({ error: 'Integration not found' })
|
|
if (!row.enabled) return reply.status(403).send({ error: 'Integration is disabled' })
|
|
return { ...row.config, ...decryptSecrets(row) }
|
|
})
|
|
|
|
// GET /settings/api/integrations/nextcloud/browse?path=/ — list directories via WebDAV PROPFIND
|
|
app.get('/integrations/nextcloud/browse', { preHandler: requireAdmin }, async (req, reply) => {
|
|
const { rows: [row] } = await pool.query('SELECT * FROM integrations WHERE slug = $1', ['nextcloud'])
|
|
if (!row?.enabled) return reply.status(400).send({ error: 'Nextcloud integration is not enabled' })
|
|
const creds = { ...row.config, ...decryptSecrets(row) }
|
|
if (!creds.base_url || !creds.username || !creds.password) {
|
|
return reply.status(400).send({ error: 'Nextcloud credentials not fully configured' })
|
|
}
|
|
|
|
const rawPath = (req.query.path || '/').replace(/\/+/g, '/')
|
|
if (rawPath.includes('..') || !rawPath.startsWith('/')) {
|
|
return reply.status(400).send({ error: 'Invalid path' })
|
|
}
|
|
const browsePath = rawPath === '/' ? '/' : rawPath.replace(/\/$/, '')
|
|
|
|
const davBase = `${creds.base_url.replace(/\/$/, '')}/remote.php/dav/files/${encodeURIComponent(creds.username)}`
|
|
const davUrl = browsePath === '/' ? `${davBase}/` : `${davBase}${browsePath}/`
|
|
const auth = Buffer.from(`${creds.username}:${creds.password}`).toString('base64')
|
|
|
|
let xmlRes
|
|
try {
|
|
xmlRes = await fetch(davUrl, {
|
|
method: 'PROPFIND',
|
|
headers: {
|
|
Authorization: `Basic ${auth}`,
|
|
Depth: '1',
|
|
'Content-Type': 'application/xml',
|
|
},
|
|
body: '<?xml version="1.0"?><d:propfind xmlns:d="DAV:"><d:prop><d:resourcetype/><d:displayname/></d:prop></d:propfind>',
|
|
signal: AbortSignal.timeout(10_000),
|
|
})
|
|
} catch (e) {
|
|
return reply.status(502).send({ error: `Could not reach Nextcloud: ${e.message}` })
|
|
}
|
|
|
|
if (xmlRes.status === 401) return reply.status(502).send({ error: 'Nextcloud credentials rejected' })
|
|
if (xmlRes.status === 404) return reply.status(404).send({ error: 'Path not found' })
|
|
if (xmlRes.status !== 207) return reply.status(502).send({ error: `Nextcloud returned ${xmlRes.status}` })
|
|
|
|
const xml = await xmlRes.text()
|
|
const prefix = `/remote.php/dav/files/${creds.username}`
|
|
const dirs = []
|
|
|
|
for (const block of xml.split(/<[^:>]*:?response[^>]*>/).slice(1)) {
|
|
if (!block.includes('collection')) continue
|
|
const m = block.match(/<[^:>]*:?href[^>]*>([^<]+)<\/[^:>]*:?href>/)
|
|
if (!m) continue
|
|
const decoded = decodeURIComponent(m[1].trim())
|
|
if (!decoded.startsWith(prefix)) continue
|
|
const relPath = decoded.slice(prefix.length).replace(/\/$/, '') || '/'
|
|
if (relPath === browsePath) continue // skip self
|
|
const name = relPath.split('/').filter(Boolean).pop() || ''
|
|
if (name) dirs.push({ name, path: relPath })
|
|
}
|
|
|
|
dirs.sort((a, b) => a.name.localeCompare(b.name))
|
|
return { path: browsePath, dirs }
|
|
})
|
|
|
|
// PUT /settings/api/integrations/newbook/rooms — save reorder + colour changes
|
|
app.put('/integrations/newbook/rooms', { preHandler: requireAdmin }, async (req, reply) => {
|
|
const { rows: [row] } = await pool.query(`SELECT value FROM global_config WHERE key = 'newbook.rooms'`)
|
|
if (!row) return reply.status(404).send({ error: 'No room data — sync first' })
|
|
const categories = (req.body?.categories ?? row.value.categories).map((c, i) => ({ ...c, sort_order: i }))
|
|
const updated = { ...row.value, categories }
|
|
await pool.query(`UPDATE global_config SET value = $1, updated_at = NOW() WHERE key = 'newbook.rooms'`, [updated])
|
|
return updated
|
|
})
|
|
}
|