Changelog
+
v1.8.0
+
+ Adds (finally!) authentication via OpenID Connect (OIDC) and Keycloak. Users must have the fullsend_access role in Keycloak to use the application and fullsend_admin to administer it.
+
v1.7.3
Adds blocking and timeouts to discourage users from sending the same message multiple times before the server has completed ingesting the message/recipient pairs
diff --git a/public/index.html b/public/index.html
index a1a9dc0..f915a7b 100644
--- a/public/index.html
+++ b/public/index.html
@@ -44,7 +44,7 @@
- Log in
+ Log in
diff --git a/public/js/changepassword.js b/public/js/changepassword.js
index 233d2ab..d33813d 100644
--- a/public/js/changepassword.js
+++ b/public/js/changepassword.js
@@ -1,12 +1,5 @@
const loadUsers = async () => {
- const session = getCookie("fullsend_session");
- const users = (
- await (
- await fetch(`/auth/api/users`, {
- headers: { session: session },
- })
- ).json()
- ).data;
+ const users = (await (await fetch(`/auth/api/users`)).json()).data;
for (const user of users) {
document.getElementById(
"changePasswordUsername"
@@ -40,11 +33,9 @@ const changePassword = async () => {
}
if (error) return -1;
- const session = getCookie("fullsend_session");
-
const result = await fetch("/auth/api/users/update/password", {
method: "POST",
- headers: { "Content-Type": "application/json", session: session },
+ headers: { "Content-Type": "application/json" },
body: JSON.stringify({
userId: userId,
password: password,
diff --git a/public/js/fullsend.js b/public/js/fullsend.js
index b2d975f..1d4eb74 100644
--- a/public/js/fullsend.js
+++ b/public/js/fullsend.js
@@ -1,41 +1,35 @@
-//TODO: this doesn't actually need isLoggedIn here, I don't think...
-//Pretty sure the redirect if not logged in (line 73ish) will cover that
+const safeJsonFetch = async (url, options = {}) => {
+ try {
+ const resp = await fetch(url, options);
+ if (!resp.ok) {
+ console.error('Fetch failed', url, resp.status, resp.statusText);
+ return null;
+ }
+ return await resp.json();
+ } catch (e) {
+ console.error('Network error fetching', url, e && e.message);
+ return null;
+ }
+};
+
const getGroups = async () => {
- const session = getCookie("fullsend_session");
- return (
- await (
- await fetch("/auth/api/groups/insequence", {
- headers: { session: session },
- })
- ).json()
- ).data;
+ const resp = await safeJsonFetch("/auth/api/groups/insequence");
+ return resp ? resp.data : [];
};
const getContactNumbersInGroup = async (group) => {
- const session = getCookie("fullsend_session");
let numbers = [];
- const contacts = (
- await (
- await fetch(`/auth/api/group/${group}/contacts`, {
- headers: { session: session },
- })
- ).json()
- ).data;
+ const resp = await safeJsonFetch(`/auth/api/group/${group}/contacts`);
+ const contacts = resp ? resp.data : [];
for (const contact of contacts) {
numbers.push(contact.phone_number);
}
+ return numbers;
};
const getContacts = async () => {
- const session = getCookie("fullsend_session");
- const contacts = (
- await (
- await fetch("/auth/api/contacts?active=1&filtered=1", {
- headers: { session: session },
- })
- ).json()
- ).data;
- return contacts;
+ const resp = await safeJsonFetch("/auth/api/contacts?active=1&filtered=1");
+ return resp ? resp.data : [];
};
const getSelectedGroups = (categories = false) => {
@@ -71,7 +65,6 @@ const getSelectedIndividuals = () => {
const handleSwitch = async (e) => {
handleMessagePreview();
- const session = getCookie("fullsend_session");
const switches = document.getElementsByClassName("recipientSwitch");
const modalBody = document.getElementById("recipientModalBody");
const viewListButton = document.getElementById("viewRecipientList");
@@ -85,16 +78,8 @@ const handleSwitch = async (e) => {
}
if (switchList.length > 0) {
- const contactList = (
- await (
- await fetch(
- `/auth/api/groups/contacts?groups=${switchList.join(",")}`,
- {
- headers: { session: session },
- }
- )
- ).json()
- ).data;
+ const contactResp = await safeJsonFetch(`/auth/api/groups/contacts?groups=${switchList.join(",")}`);
+ const contactList = contactResp ? contactResp.data : [];
if (contactList.length > 0) {
modalBody.innerHTML = `
@@ -142,14 +127,14 @@ const sendMessage = async () => {
}
if (error) return -1;
- const session = getCookie("fullsend_session");
+
document.getElementById("sendButton").disabled = true;
document.getElementById("fullsendMessage").disabled = true;
const result = await fetch("/auth/api/messages/send", {
method: "POST",
- headers: { "Content-Type": "application/json", session: session },
+ headers: { "Content-Type": "application/json" },
body: JSON.stringify({
message: message,
groups: selectedGroups,
diff --git a/public/js/group-management.js b/public/js/group-management.js
index 1c1bba8..42b000e 100644
--- a/public/js/group-management.js
+++ b/public/js/group-management.js
@@ -1,27 +1,10 @@
let recipientListReady = false;
let currentGroup;
-const getGroups = async () => {
- const session = getCookie("fullsend_session");
- return (
- await (
- await fetch("/auth/api/groups/insequence", {
- headers: { session: session },
- })
- ).json()
- ).data;
-};
+const getGroups = async () => (await (await fetch("/auth/api/groups/insequence")).json()).data;
const loadContacts = async () => {
- const session = getCookie("fullsend_session");
-
- const contacts = await (
- await (
- await fetch("/auth/api/contacts?active=1", {
- headers: { session: session },
- })
- ).json()
- ).data;
+ const contacts = (await (await fetch("/auth/api/contacts?active=1")).json()).data;
document.getElementById("groupManagementRecipientsLabel").style.display =
"block";
@@ -38,15 +21,7 @@ const loadContacts = async () => {
const setGroupContacts = async (groupId) => {
recipientListReady = false;
- const session = getCookie("fullsend_session");
-
- const contacts = await (
- await (
- await fetch(`/auth/api/group/${groupId}/contacts`, {
- headers: { session: session },
- })
- ).json()
- ).data;
+ const contacts = (await (await fetch(`/auth/api/group/${groupId}/contacts`)).json()).data;
const checkboxes = document.getElementsByClassName("recipient-switch");
for (const checkbox of checkboxes) {
@@ -62,8 +37,7 @@ const setGroupContacts = async (groupId) => {
};
const handleSwitch = async (e) => {
- const session = getCookie("fullsend_session");
-
+
if (!recipientListReady) return;
const userId = e.target.value;
const action = e.target.checked ? "add" : "remove";
@@ -71,7 +45,7 @@ const handleSwitch = async (e) => {
if (action == "add") {
const result = await fetch("/auth/api/groups/update/addcontact", {
method: "POST",
- headers: { "Content-Type": "application/json", session: session },
+ headers: { "Content-Type": "application/json" },
body: JSON.stringify({
contactId: userId,
groupId: currentGroup,
@@ -81,7 +55,7 @@ const handleSwitch = async (e) => {
} else if (action == "remove") {
const result = await fetch("/auth/api/groups/update/removecontact", {
method: "POST",
- headers: { "Content-Type": "application/json", session: session },
+ headers: { "Content-Type": "application/json" },
body: JSON.stringify({
contactId: userId,
groupId: currentGroup,
diff --git a/public/js/login.js b/public/js/login.js
index 372191b..962e597 100644
--- a/public/js/login.js
+++ b/public/js/login.js
@@ -4,30 +4,8 @@ const handle403 = () => {
};
const login = async () => {
- const username = document.getElementById("loginUsername").value;
- const password = document.getElementById("loginPassword").value;
-
- const session = await (
- await fetch("/api/login", {
- method: "POST",
- headers: { "Content-Type": "application/json" },
- body: JSON.stringify({
- username: username,
- password: password,
- }),
- })
- ).json();
-
- if (session.code && session.code == 403) {
- return handle403();
- }
-
- const days = 5;
- const expires = new Date(Date.now() + days * 86400 * 1000).toUTCString();
-
- document.cookie = `fullsend_session=${await session.session}; expires=${expires}`;
-
- window.location.href = "/fullsend";
+ // Redirect to server which initiates Keycloak login
+ window.location.href = "/api/login";
};
const pageOnLoadFunctions = async () => {
diff --git a/public/js/main.js b/public/js/main.js
index 2652345..22afe1c 100644
--- a/public/js/main.js
+++ b/public/js/main.js
@@ -1,18 +1,4 @@
-const getCookie = (cname) => {
- let name = cname + "=";
- let decodedCookie = decodeURIComponent(document.cookie);
- let ca = decodedCookie.split(";");
- for (let i = 0; i < ca.length; i++) {
- let c = ca[i];
- while (c.charAt(0) == " ") {
- c = c.substring(1);
- }
- if (c.indexOf(name) == 0) {
- return c.substring(name.length, c.length);
- }
- }
- return undefined;
-};
+// cookie helper removed — server now manages sessions via OIDC
const getVersion = async () => {
const version = (await fetch("/api/version")).text();
@@ -24,64 +10,45 @@ const printVersionInNav = async () => {
};
const checkLogin = async () => {
- const session = getCookie("fullsend_session");
- const login = (
- await fetch("/auth/api/session/" + session, {
- headers: { session: session },
- })
- ).json();
- if ((await login).code == 401) {
- logout();
- }
- return login;
+ // Ask the server for session info (server reads token from session or Authorization)
+ const resp = await fetch('/auth/api/session/info');
+ if (resp.status === 200) return resp.json();
+ return { success: false };
};
const isLoggedIn = async () => {
- const session = getCookie("fullsend_session");
- if (!session) return false;
- const login = (
- await fetch("/auth/api/session/" + session, {
- headers: { session: session },
- })
- ).json();
- if ((await login).code == 401) {
- return false;
- }
-
- const days = 5;
- const expires = new Date(Date.now() + days * 86400 * 1000).toUTCString();
-
- document.cookie = `fullsend_session=${session}; expires=${expires}`;
-
- return true;
+ const info = await checkLogin();
+ return info && info.success;
};
const isAdmin = async (userId = null) => {
- const session = getCookie("fullsend_session");
- if (!session) return;
-
- if (!userId) {
- userId = (await checkLogin()).data[0].user_id;
+ const info = await checkLogin();
+ if (!info || !info.success) return false;
+ // If server returned localUser, respect that flag; otherwise inspect claims
+ if (info.data && info.data.localUser && info.data.localUser.admin) return true;
+ const claims = info.data && info.data.sessionInfo && info.data.sessionInfo.claims;
+ if (!claims) return false;
+ const realmRoles = (claims.realm_access && claims.realm_access.roles) || [];
+ // Server should expose which role name represents admin; fall back to 'admin'
+ const adminRole = (info.data && info.data.sessionInfo && info.data.sessionInfo.adminRole) || 'admin';
+ if (realmRoles.includes(adminRole)) return true;
+ if (claims.resource_access) {
+ // Try to find admin role in any client resource_access entry
+ for (const clientKey of Object.keys(claims.resource_access)) {
+ const ra = claims.resource_access[clientKey];
+ if (ra && ra.roles && ra.roles.includes(adminRole)) return true;
+ }
}
- const userInfo = (
- await (
- await fetch(`/auth/api/user/${userId}`, {
- headers: { session: session },
- })
- ).json()
- ).data[0];
- return userInfo.admin;
+ return false;
};
const logout = async () => {
- const session = getCookie("fullsend_session");
try {
- await fetch("/api/logout", { headers: { session } });
+ window.location.href = '/api/logout';
} catch (e) {
- console.error("Logout request failed:", e);
+ console.error('Logout failed', e);
+ window.location.href = '/';
}
- document.cookie = "fullsend_session=; expires=Thu, 01 Jan 1970 00:00:00 UTC;";
- window.location.href = "/";
};
const checkForRedirect = async () => {
@@ -101,7 +68,6 @@ const checkForRedirect = async () => {
for (const page of [authPages, adminPages]) {
if (window.location.pathname == page && !isLoggedInVar) {
- logout();
window.location.href = "/";
return;
}
diff --git a/public/no-access.html b/public/no-access.html
new file mode 100644
index 0000000..7b19aed
--- /dev/null
+++ b/public/no-access.html
@@ -0,0 +1,61 @@
+
+
+
+ Fullsend | SMS notification from the web
+
+
+
+
+
+
+
Access denied
+
It looks like your account does not have permission to use Fullsend.
+
If you believe this is an error, please contact your administrator to request the fullsend_access role.
+
Return to home
+
- Log in
- Log out
+ Log in
+ Log out
diff --git a/public/terms.html b/public/terms.html
index 3010a4f..9255bd6 100644
--- a/public/terms.html
+++ b/public/terms.html
@@ -44,8 +44,8 @@
- Log in
- Log out
+ Log in
+ Log out
diff --git a/server.js b/server.js
index 570d87d..68622e0 100644
--- a/server.js
+++ b/server.js
@@ -11,7 +11,9 @@ const groups = require("./src/groups.js");
const titles = require("./src/titles.js");
const users = require("./src/users.js");
const sessions = require("./src/sessions.js");
+const auth = require("./src/auth.js");
const messages = require("./src/messages.js");
+const session = require('express-session');
const { version } = require("./package.json");
const { response } = require("express");
@@ -28,35 +30,22 @@ const pool = mariadb.createPool({
// Initialize express app
const PORT = process.env.PORT || 8080;
-const isLoggedIn = async (req, res, next) => {
- //"Checking session...
- if (req.headers.session) {
- //A session token was passed back, now checking if it is valid...
- const session = await sessions.getSession(pool, req.headers.session);
- if (session.data[0]) {
- req.body.sessionInfo = session.data[0];
- // Valid session token found
- sessions.sessionUpdate(pool, req.headers.session);
- next();
- } else {
- //The token passed back is invalid
- res.status(401).send({ code: 401, error: "Unauthorized" });
- }
- } else {
- // "No session token passed back
- res.status(401).send({ code: 401, error: "Unauthorized" });
- }
-};
+// Session middleware (required for server-side login flow)
+app.use(session({
+ secret: process.env.SESSION_SECRET || 'a very long secret',
+ resave: false,
+ saveUninitialized: false,
+ cookie: { secure: false }, // set secure: true if using HTTPS
+}));
-const isAdmin = async (req, res, next) => {
- const userInfo = (await users.getUser(pool, req.body.sessionInfo.user_id))
- .data[0];
- if (userInfo.admin == 1) {
- next();
- } else {
- res.status(403).send({ code: 403, error: "Forbidden" });
- }
-};
+// Initialize OIDC discovery (will be awaited before server starts)
+// Note: initOidc is async; we'll call it before starting the server below.
+
+const isLoggedIn = auth.isLoggedIn;
+
+// Use Keycloak roles for admin checks. If you want to rely on local DB admin flag
+// instead, change this to query users.getUserByUsername.
+const isAdmin = auth.isAdmin;
// auth router, anything on this router requires signin
const authRouter = express.Router();
@@ -101,6 +90,11 @@ app.get("/group-management", (req, res) => {
res.sendFile(path.join(__dirname, "public/group-management.html"));
});
+app.get("/no-access", (req, res) => {
+ res.sendFile(path.join(__dirname, "public/no-access.html"));
+});
+
+
app.get("/api", async (req, res) => {
res.send(`fullsend server is online