1406 lines
39 KiB
TypeScript
1406 lines
39 KiB
TypeScript
import express from "express";
|
|
import { db } from "../db/index.js";
|
|
import { sshCredentials, sshCredentialUsage, sshData } from "../db/schema.js";
|
|
import { eq, and, desc, sql } from "drizzle-orm";
|
|
import type { Request, Response, NextFunction } from "express";
|
|
import jwt from "jsonwebtoken";
|
|
import { authLogger } from "../../utils/logger.js";
|
|
import { SimpleDBOps } from "../../utils/simple-db-ops.js";
|
|
import { AuthManager } from "../../utils/auth-manager.js";
|
|
import {
|
|
parseSSHKey,
|
|
parsePublicKey,
|
|
detectKeyType,
|
|
validateKeyPair,
|
|
} from "../../utils/ssh-key-utils.js";
|
|
import crypto from "crypto";
|
|
import ssh2Pkg from "ssh2";
|
|
const { utils: ssh2Utils, Client } = ssh2Pkg;
|
|
|
|
// Direct SSH key generation with ssh2 - the right way
|
|
function generateSSHKeyPair(
|
|
keyType: string,
|
|
keySize?: number,
|
|
passphrase?: string,
|
|
): {
|
|
success: boolean;
|
|
privateKey?: string;
|
|
publicKey?: string;
|
|
error?: string;
|
|
} {
|
|
try {
|
|
// Convert our keyType to ssh2 format
|
|
let ssh2Type = keyType;
|
|
const options: any = {};
|
|
|
|
if (keyType === "ssh-rsa") {
|
|
ssh2Type = "rsa";
|
|
options.bits = keySize || 2048;
|
|
} else if (keyType === "ssh-ed25519") {
|
|
ssh2Type = "ed25519";
|
|
} else if (keyType === "ecdsa-sha2-nistp256") {
|
|
ssh2Type = "ecdsa";
|
|
options.bits = 256; // ECDSA P-256 uses 256 bits
|
|
}
|
|
|
|
// Add passphrase protection if provided
|
|
if (passphrase && passphrase.trim()) {
|
|
options.passphrase = passphrase;
|
|
options.cipher = "aes128-cbc"; // Default cipher for encrypted private keys
|
|
}
|
|
|
|
// Use ssh2's native key generation
|
|
const keyPair = ssh2Utils.generateKeyPairSync(ssh2Type as any, options);
|
|
|
|
return {
|
|
success: true,
|
|
privateKey: keyPair.private,
|
|
publicKey: keyPair.public,
|
|
};
|
|
} catch (error) {
|
|
return {
|
|
success: false,
|
|
error:
|
|
error instanceof Error ? error.message : "SSH key generation failed",
|
|
};
|
|
}
|
|
}
|
|
|
|
const router = express.Router();
|
|
|
|
interface JWTPayload {
|
|
userId: string;
|
|
iat?: number;
|
|
exp?: number;
|
|
}
|
|
|
|
function isNonEmptyString(val: any): val is string {
|
|
return typeof val === "string" && val.trim().length > 0;
|
|
}
|
|
|
|
// Use AuthManager middleware for authentication
|
|
const authManager = AuthManager.getInstance();
|
|
const authenticateJWT = authManager.createAuthMiddleware();
|
|
const requireDataAccess = authManager.createDataAccessMiddleware();
|
|
|
|
// Create a new credential
|
|
// POST /credentials
|
|
router.post("/", authenticateJWT, requireDataAccess, async (req: Request, res: Response) => {
|
|
const userId = (req as any).userId;
|
|
const {
|
|
name,
|
|
description,
|
|
folder,
|
|
tags,
|
|
authType,
|
|
username,
|
|
password,
|
|
key,
|
|
keyPassword,
|
|
keyType,
|
|
} = req.body;
|
|
|
|
if (
|
|
!isNonEmptyString(userId) ||
|
|
!isNonEmptyString(name) ||
|
|
!isNonEmptyString(username)
|
|
) {
|
|
authLogger.warn("Invalid credential creation data validation failed", {
|
|
operation: "credential_create",
|
|
userId,
|
|
hasName: !!name,
|
|
hasUsername: !!username,
|
|
});
|
|
return res.status(400).json({ error: "Name and username are required" });
|
|
}
|
|
|
|
if (!["password", "key"].includes(authType)) {
|
|
authLogger.warn("Invalid auth type provided", {
|
|
operation: "credential_create",
|
|
userId,
|
|
name,
|
|
authType,
|
|
});
|
|
return res
|
|
.status(400)
|
|
.json({ error: 'Auth type must be "password" or "key"' });
|
|
}
|
|
|
|
try {
|
|
if (authType === "password" && !password) {
|
|
authLogger.warn("Password required for password authentication", {
|
|
operation: "credential_create",
|
|
userId,
|
|
name,
|
|
authType,
|
|
});
|
|
return res
|
|
.status(400)
|
|
.json({ error: "Password is required for password authentication" });
|
|
}
|
|
if (authType === "key" && !key) {
|
|
authLogger.warn("SSH key required for key authentication", {
|
|
operation: "credential_create",
|
|
userId,
|
|
name,
|
|
authType,
|
|
});
|
|
return res
|
|
.status(400)
|
|
.json({ error: "SSH key is required for key authentication" });
|
|
}
|
|
const plainPassword = authType === "password" && password ? password : null;
|
|
const plainKey = authType === "key" && key ? key : null;
|
|
const plainKeyPassword =
|
|
authType === "key" && keyPassword ? keyPassword : null;
|
|
|
|
let keyInfo = null;
|
|
if (authType === "key" && plainKey) {
|
|
keyInfo = parseSSHKey(plainKey, plainKeyPassword);
|
|
if (!keyInfo.success) {
|
|
authLogger.warn("SSH key parsing failed", {
|
|
operation: "credential_create",
|
|
userId,
|
|
name,
|
|
error: keyInfo.error,
|
|
});
|
|
return res.status(400).json({
|
|
error: `Invalid SSH key: ${keyInfo.error}`,
|
|
});
|
|
}
|
|
}
|
|
|
|
const credentialData = {
|
|
userId,
|
|
name: name.trim(),
|
|
description: description?.trim() || null,
|
|
folder: folder?.trim() || null,
|
|
tags: Array.isArray(tags) ? tags.join(",") : tags || "",
|
|
authType,
|
|
username: username.trim(),
|
|
password: plainPassword,
|
|
key: plainKey, // backward compatibility
|
|
privateKey: keyInfo?.privateKey || plainKey,
|
|
publicKey: keyInfo?.publicKey || null,
|
|
keyPassword: plainKeyPassword,
|
|
keyType: keyType || null,
|
|
detectedKeyType: keyInfo?.keyType || null,
|
|
usageCount: 0,
|
|
lastUsed: null,
|
|
};
|
|
|
|
const created = (await SimpleDBOps.insert(
|
|
sshCredentials,
|
|
"ssh_credentials",
|
|
credentialData,
|
|
userId,
|
|
)) as typeof credentialData & { id: number };
|
|
|
|
authLogger.success(
|
|
`SSH credential created: ${name} (${authType}) by user ${userId}`,
|
|
{
|
|
operation: "credential_create_success",
|
|
userId,
|
|
credentialId: created.id,
|
|
name,
|
|
authType,
|
|
username,
|
|
},
|
|
);
|
|
|
|
res.status(201).json(formatCredentialOutput(created));
|
|
} catch (err) {
|
|
authLogger.error("Failed to create credential in database", err, {
|
|
operation: "credential_create",
|
|
userId,
|
|
name,
|
|
authType,
|
|
username,
|
|
});
|
|
res.status(500).json({
|
|
error: err instanceof Error ? err.message : "Failed to create credential",
|
|
});
|
|
}
|
|
});
|
|
|
|
// Get all credentials for the authenticated user
|
|
// GET /credentials
|
|
router.get("/", authenticateJWT, requireDataAccess, async (req: Request, res: Response) => {
|
|
const userId = (req as any).userId;
|
|
|
|
if (!isNonEmptyString(userId)) {
|
|
authLogger.warn("Invalid userId for credential fetch");
|
|
return res.status(400).json({ error: "Invalid userId" });
|
|
}
|
|
|
|
try {
|
|
const credentials = await SimpleDBOps.select(
|
|
db
|
|
.select()
|
|
.from(sshCredentials)
|
|
.where(eq(sshCredentials.userId, userId))
|
|
.orderBy(desc(sshCredentials.updatedAt)),
|
|
"ssh_credentials",
|
|
userId,
|
|
);
|
|
|
|
res.json(credentials.map((cred) => formatCredentialOutput(cred)));
|
|
} catch (err) {
|
|
authLogger.error("Failed to fetch credentials", err);
|
|
res.status(500).json({ error: "Failed to fetch credentials" });
|
|
}
|
|
});
|
|
|
|
// Get all unique credential folders for the authenticated user
|
|
// GET /credentials/folders
|
|
router.get("/folders", authenticateJWT, requireDataAccess, async (req: Request, res: Response) => {
|
|
const userId = (req as any).userId;
|
|
|
|
if (!isNonEmptyString(userId)) {
|
|
authLogger.warn("Invalid userId for credential folder fetch");
|
|
return res.status(400).json({ error: "Invalid userId" });
|
|
}
|
|
|
|
try {
|
|
const result = await db
|
|
.select({ folder: sshCredentials.folder })
|
|
.from(sshCredentials)
|
|
.where(eq(sshCredentials.userId, userId));
|
|
|
|
const folderCounts: Record<string, number> = {};
|
|
result.forEach((r) => {
|
|
if (r.folder && r.folder.trim() !== "") {
|
|
folderCounts[r.folder] = (folderCounts[r.folder] || 0) + 1;
|
|
}
|
|
});
|
|
|
|
const folders = Object.keys(folderCounts).filter(
|
|
(folder) => folderCounts[folder] > 0,
|
|
);
|
|
res.json(folders);
|
|
} catch (err) {
|
|
authLogger.error("Failed to fetch credential folders", err);
|
|
res.status(500).json({ error: "Failed to fetch credential folders" });
|
|
}
|
|
});
|
|
|
|
// Get a specific credential by ID (with plain text secrets)
|
|
// GET /credentials/:id
|
|
router.get("/:id", authenticateJWT, requireDataAccess, async (req: Request, res: Response) => {
|
|
const userId = (req as any).userId;
|
|
const { id } = req.params;
|
|
|
|
if (!isNonEmptyString(userId) || !id) {
|
|
authLogger.warn("Invalid request for credential fetch");
|
|
return res.status(400).json({ error: "Invalid request" });
|
|
}
|
|
|
|
try {
|
|
const credentials = await SimpleDBOps.select(
|
|
db
|
|
.select()
|
|
.from(sshCredentials)
|
|
.where(
|
|
and(
|
|
eq(sshCredentials.id, parseInt(id)),
|
|
eq(sshCredentials.userId, userId),
|
|
),
|
|
),
|
|
"ssh_credentials",
|
|
userId,
|
|
);
|
|
|
|
if (credentials.length === 0) {
|
|
return res.status(404).json({ error: "Credential not found" });
|
|
}
|
|
|
|
const credential = credentials[0];
|
|
const output = formatCredentialOutput(credential);
|
|
|
|
if (credential.password) {
|
|
(output as any).password = credential.password;
|
|
}
|
|
if (credential.key) {
|
|
(output as any).key = credential.key; // backward compatibility
|
|
}
|
|
if (credential.privateKey) {
|
|
(output as any).privateKey = credential.privateKey;
|
|
}
|
|
if (credential.publicKey) {
|
|
(output as any).publicKey = credential.publicKey;
|
|
}
|
|
if (credential.keyPassword) {
|
|
(output as any).keyPassword = credential.keyPassword;
|
|
}
|
|
|
|
res.json(output);
|
|
} catch (err) {
|
|
authLogger.error("Failed to fetch credential", err);
|
|
res.status(500).json({
|
|
error: err instanceof Error ? err.message : "Failed to fetch credential",
|
|
});
|
|
}
|
|
});
|
|
|
|
// Update a credential
|
|
// PUT /credentials/:id
|
|
router.put("/:id", authenticateJWT, requireDataAccess, async (req: Request, res: Response) => {
|
|
const userId = (req as any).userId;
|
|
const { id } = req.params;
|
|
const updateData = req.body;
|
|
|
|
if (!isNonEmptyString(userId) || !id) {
|
|
authLogger.warn("Invalid request for credential update");
|
|
return res.status(400).json({ error: "Invalid request" });
|
|
}
|
|
|
|
try {
|
|
const existing = await db
|
|
.select()
|
|
.from(sshCredentials)
|
|
.where(
|
|
and(
|
|
eq(sshCredentials.id, parseInt(id)),
|
|
eq(sshCredentials.userId, userId),
|
|
),
|
|
);
|
|
|
|
if (existing.length === 0) {
|
|
return res.status(404).json({ error: "Credential not found" });
|
|
}
|
|
|
|
const updateFields: any = {};
|
|
|
|
if (updateData.name !== undefined)
|
|
updateFields.name = updateData.name.trim();
|
|
if (updateData.description !== undefined)
|
|
updateFields.description = updateData.description?.trim() || null;
|
|
if (updateData.folder !== undefined)
|
|
updateFields.folder = updateData.folder?.trim() || null;
|
|
if (updateData.tags !== undefined) {
|
|
updateFields.tags = Array.isArray(updateData.tags)
|
|
? updateData.tags.join(",")
|
|
: updateData.tags || "";
|
|
}
|
|
if (updateData.username !== undefined)
|
|
updateFields.username = updateData.username.trim();
|
|
if (updateData.authType !== undefined)
|
|
updateFields.authType = updateData.authType;
|
|
if (updateData.keyType !== undefined)
|
|
updateFields.keyType = updateData.keyType;
|
|
|
|
if (updateData.password !== undefined) {
|
|
updateFields.password = updateData.password || null;
|
|
}
|
|
if (updateData.key !== undefined) {
|
|
updateFields.key = updateData.key || null; // backward compatibility
|
|
|
|
// Parse SSH key if provided
|
|
if (updateData.key && existing[0].authType === "key") {
|
|
const keyInfo = parseSSHKey(updateData.key, updateData.keyPassword);
|
|
if (!keyInfo.success) {
|
|
authLogger.warn("SSH key parsing failed during update", {
|
|
operation: "credential_update",
|
|
userId,
|
|
credentialId: parseInt(id),
|
|
error: keyInfo.error,
|
|
});
|
|
return res.status(400).json({
|
|
error: `Invalid SSH key: ${keyInfo.error}`,
|
|
});
|
|
}
|
|
updateFields.privateKey = keyInfo.privateKey;
|
|
updateFields.publicKey = keyInfo.publicKey;
|
|
updateFields.detectedKeyType = keyInfo.keyType;
|
|
}
|
|
}
|
|
if (updateData.keyPassword !== undefined) {
|
|
updateFields.keyPassword = updateData.keyPassword || null;
|
|
}
|
|
|
|
if (Object.keys(updateFields).length === 0) {
|
|
const existing = await SimpleDBOps.select(
|
|
db
|
|
.select()
|
|
.from(sshCredentials)
|
|
.where(eq(sshCredentials.id, parseInt(id))),
|
|
"ssh_credentials",
|
|
userId,
|
|
);
|
|
|
|
return res.json(formatCredentialOutput(existing[0]));
|
|
}
|
|
|
|
await SimpleDBOps.update(
|
|
sshCredentials,
|
|
"ssh_credentials",
|
|
and(
|
|
eq(sshCredentials.id, parseInt(id)),
|
|
eq(sshCredentials.userId, userId),
|
|
),
|
|
updateFields,
|
|
userId,
|
|
);
|
|
|
|
const updated = await SimpleDBOps.select(
|
|
db
|
|
.select()
|
|
.from(sshCredentials)
|
|
.where(eq(sshCredentials.id, parseInt(id))),
|
|
"ssh_credentials",
|
|
userId,
|
|
);
|
|
|
|
const credential = updated[0];
|
|
authLogger.success(
|
|
`SSH credential updated: ${credential.name} (${credential.authType}) by user ${userId}`,
|
|
{
|
|
operation: "credential_update_success",
|
|
userId,
|
|
credentialId: parseInt(id),
|
|
name: credential.name,
|
|
authType: credential.authType,
|
|
username: credential.username,
|
|
},
|
|
);
|
|
|
|
res.json(formatCredentialOutput(updated[0]));
|
|
} catch (err) {
|
|
authLogger.error("Failed to update credential", err);
|
|
res.status(500).json({
|
|
error: err instanceof Error ? err.message : "Failed to update credential",
|
|
});
|
|
}
|
|
});
|
|
|
|
// Delete a credential
|
|
// DELETE /credentials/:id
|
|
router.delete("/:id", authenticateJWT, requireDataAccess, async (req: Request, res: Response) => {
|
|
const userId = (req as any).userId;
|
|
const { id } = req.params;
|
|
|
|
if (!isNonEmptyString(userId) || !id) {
|
|
authLogger.warn("Invalid request for credential deletion");
|
|
return res.status(400).json({ error: "Invalid request" });
|
|
}
|
|
|
|
try {
|
|
const credentialToDelete = await db
|
|
.select()
|
|
.from(sshCredentials)
|
|
.where(
|
|
and(
|
|
eq(sshCredentials.id, parseInt(id)),
|
|
eq(sshCredentials.userId, userId),
|
|
),
|
|
);
|
|
|
|
if (credentialToDelete.length === 0) {
|
|
return res.status(404).json({ error: "Credential not found" });
|
|
}
|
|
|
|
const hostsUsingCredential = await db
|
|
.select()
|
|
.from(sshData)
|
|
.where(
|
|
and(eq(sshData.credentialId, parseInt(id)), eq(sshData.userId, userId)),
|
|
);
|
|
|
|
if (hostsUsingCredential.length > 0) {
|
|
await db
|
|
.update(sshData)
|
|
.set({
|
|
credentialId: null,
|
|
password: null,
|
|
key: null,
|
|
keyPassword: null,
|
|
authType: "password",
|
|
})
|
|
.where(
|
|
and(
|
|
eq(sshData.credentialId, parseInt(id)),
|
|
eq(sshData.userId, userId),
|
|
),
|
|
);
|
|
}
|
|
|
|
await db
|
|
.delete(sshCredentialUsage)
|
|
.where(
|
|
and(
|
|
eq(sshCredentialUsage.credentialId, parseInt(id)),
|
|
eq(sshCredentialUsage.userId, userId),
|
|
),
|
|
);
|
|
|
|
await db
|
|
.delete(sshCredentials)
|
|
.where(
|
|
and(
|
|
eq(sshCredentials.id, parseInt(id)),
|
|
eq(sshCredentials.userId, userId),
|
|
),
|
|
);
|
|
|
|
const credential = credentialToDelete[0];
|
|
authLogger.success(
|
|
`SSH credential deleted: ${credential.name} (${credential.authType}) by user ${userId}`,
|
|
{
|
|
operation: "credential_delete_success",
|
|
userId,
|
|
credentialId: parseInt(id),
|
|
name: credential.name,
|
|
authType: credential.authType,
|
|
username: credential.username,
|
|
},
|
|
);
|
|
|
|
res.json({ message: "Credential deleted successfully" });
|
|
} catch (err) {
|
|
authLogger.error("Failed to delete credential", err);
|
|
res.status(500).json({
|
|
error: err instanceof Error ? err.message : "Failed to delete credential",
|
|
});
|
|
}
|
|
});
|
|
|
|
// Apply a credential to an SSH host (for quick application)
|
|
// POST /credentials/:id/apply-to-host/:hostId
|
|
router.post(
|
|
"/:id/apply-to-host/:hostId",
|
|
authenticateJWT,
|
|
async (req: Request, res: Response) => {
|
|
const userId = (req as any).userId;
|
|
const { id: credentialId, hostId } = req.params;
|
|
|
|
if (!isNonEmptyString(userId) || !credentialId || !hostId) {
|
|
authLogger.warn("Invalid request for credential application");
|
|
return res.status(400).json({ error: "Invalid request" });
|
|
}
|
|
|
|
try {
|
|
const credentials = await db
|
|
.select()
|
|
.from(sshCredentials)
|
|
.where(
|
|
and(
|
|
eq(sshCredentials.id, parseInt(credentialId)),
|
|
eq(sshCredentials.userId, userId),
|
|
),
|
|
);
|
|
|
|
if (credentials.length === 0) {
|
|
return res.status(404).json({ error: "Credential not found" });
|
|
}
|
|
|
|
const credential = credentials[0];
|
|
|
|
await db
|
|
.update(sshData)
|
|
.set({
|
|
credentialId: parseInt(credentialId),
|
|
username: credential.username,
|
|
authType: credential.authType,
|
|
password: null,
|
|
key: null,
|
|
keyPassword: null,
|
|
keyType: null,
|
|
updatedAt: new Date().toISOString(),
|
|
})
|
|
.where(
|
|
and(eq(sshData.id, parseInt(hostId)), eq(sshData.userId, userId)),
|
|
);
|
|
|
|
await db.insert(sshCredentialUsage).values({
|
|
credentialId: parseInt(credentialId),
|
|
hostId: parseInt(hostId),
|
|
userId,
|
|
});
|
|
|
|
await db
|
|
.update(sshCredentials)
|
|
.set({
|
|
usageCount: sql`${sshCredentials.usageCount}
|
|
+ 1`,
|
|
lastUsed: new Date().toISOString(),
|
|
updatedAt: new Date().toISOString(),
|
|
})
|
|
.where(eq(sshCredentials.id, parseInt(credentialId)));
|
|
res.json({ message: "Credential applied to host successfully" });
|
|
} catch (err) {
|
|
authLogger.error("Failed to apply credential to host", err);
|
|
res.status(500).json({
|
|
error:
|
|
err instanceof Error
|
|
? err.message
|
|
: "Failed to apply credential to host",
|
|
});
|
|
}
|
|
},
|
|
);
|
|
|
|
// Get hosts using a specific credential
|
|
// GET /credentials/:id/hosts
|
|
router.get(
|
|
"/:id/hosts",
|
|
authenticateJWT,
|
|
async (req: Request, res: Response) => {
|
|
const userId = (req as any).userId;
|
|
const { id: credentialId } = req.params;
|
|
|
|
if (!isNonEmptyString(userId) || !credentialId) {
|
|
authLogger.warn("Invalid request for credential hosts fetch");
|
|
return res.status(400).json({ error: "Invalid request" });
|
|
}
|
|
|
|
try {
|
|
const hosts = await db
|
|
.select()
|
|
.from(sshData)
|
|
.where(
|
|
and(
|
|
eq(sshData.credentialId, parseInt(credentialId)),
|
|
eq(sshData.userId, userId),
|
|
),
|
|
);
|
|
|
|
res.json(hosts.map((host) => formatSSHHostOutput(host)));
|
|
} catch (err) {
|
|
authLogger.error("Failed to fetch hosts using credential", err);
|
|
res.status(500).json({
|
|
error:
|
|
err instanceof Error
|
|
? err.message
|
|
: "Failed to fetch hosts using credential",
|
|
});
|
|
}
|
|
},
|
|
);
|
|
|
|
function formatCredentialOutput(credential: any): any {
|
|
return {
|
|
id: credential.id,
|
|
name: credential.name,
|
|
description: credential.description,
|
|
folder: credential.folder,
|
|
tags:
|
|
typeof credential.tags === "string"
|
|
? credential.tags
|
|
? credential.tags.split(",").filter(Boolean)
|
|
: []
|
|
: [],
|
|
authType: credential.authType,
|
|
username: credential.username,
|
|
publicKey: credential.publicKey,
|
|
keyType: credential.keyType,
|
|
detectedKeyType: credential.detectedKeyType,
|
|
usageCount: credential.usageCount || 0,
|
|
lastUsed: credential.lastUsed,
|
|
createdAt: credential.createdAt,
|
|
updatedAt: credential.updatedAt,
|
|
};
|
|
}
|
|
|
|
function formatSSHHostOutput(host: any): any {
|
|
return {
|
|
id: host.id,
|
|
userId: host.userId,
|
|
name: host.name,
|
|
ip: host.ip,
|
|
port: host.port,
|
|
username: host.username,
|
|
folder: host.folder,
|
|
tags:
|
|
typeof host.tags === "string"
|
|
? host.tags
|
|
? host.tags.split(",").filter(Boolean)
|
|
: []
|
|
: [],
|
|
pin: !!host.pin,
|
|
authType: host.authType,
|
|
enableTerminal: !!host.enableTerminal,
|
|
enableTunnel: !!host.enableTunnel,
|
|
tunnelConnections: host.tunnelConnections
|
|
? JSON.parse(host.tunnelConnections)
|
|
: [],
|
|
enableFileManager: !!host.enableFileManager,
|
|
defaultPath: host.defaultPath,
|
|
createdAt: host.createdAt,
|
|
updatedAt: host.updatedAt,
|
|
};
|
|
}
|
|
|
|
// Rename a credential folder
|
|
// PUT /credentials/folders/rename
|
|
router.put(
|
|
"/folders/rename",
|
|
authenticateJWT,
|
|
async (req: Request, res: Response) => {
|
|
const userId = (req as any).userId;
|
|
const { oldName, newName } = req.body;
|
|
|
|
if (!isNonEmptyString(oldName) || !isNonEmptyString(newName)) {
|
|
return res
|
|
.status(400)
|
|
.json({ error: "Both oldName and newName are required" });
|
|
}
|
|
|
|
if (oldName === newName) {
|
|
return res
|
|
.status(400)
|
|
.json({ error: "Old name and new name cannot be the same" });
|
|
}
|
|
|
|
try {
|
|
await db
|
|
.update(sshCredentials)
|
|
.set({ folder: newName })
|
|
.where(
|
|
and(
|
|
eq(sshCredentials.userId, userId),
|
|
eq(sshCredentials.folder, oldName),
|
|
),
|
|
);
|
|
|
|
res.json({ success: true, message: "Folder renamed successfully" });
|
|
} catch (error) {
|
|
authLogger.error("Error renaming credential folder:", error);
|
|
res.status(500).json({ error: "Failed to rename folder" });
|
|
}
|
|
},
|
|
);
|
|
|
|
// Detect SSH key type endpoint
|
|
// POST /credentials/detect-key-type
|
|
router.post(
|
|
"/detect-key-type",
|
|
authenticateJWT,
|
|
async (req: Request, res: Response) => {
|
|
const { privateKey, keyPassword } = req.body;
|
|
|
|
if (!privateKey || typeof privateKey !== "string") {
|
|
return res.status(400).json({ error: "Private key is required" });
|
|
}
|
|
|
|
try {
|
|
const keyInfo = parseSSHKey(privateKey, keyPassword);
|
|
|
|
const response = {
|
|
success: keyInfo.success,
|
|
keyType: keyInfo.keyType,
|
|
detectedKeyType: keyInfo.keyType,
|
|
hasPublicKey: !!keyInfo.publicKey,
|
|
error: keyInfo.error || null,
|
|
};
|
|
|
|
res.json(response);
|
|
} catch (error) {
|
|
authLogger.error("Failed to detect key type", error);
|
|
res.status(500).json({
|
|
error:
|
|
error instanceof Error ? error.message : "Failed to detect key type",
|
|
});
|
|
}
|
|
},
|
|
);
|
|
|
|
// Detect SSH public key type endpoint
|
|
// POST /credentials/detect-public-key-type
|
|
router.post(
|
|
"/detect-public-key-type",
|
|
authenticateJWT,
|
|
async (req: Request, res: Response) => {
|
|
const { publicKey } = req.body;
|
|
|
|
if (!publicKey || typeof publicKey !== "string") {
|
|
return res.status(400).json({ error: "Public key is required" });
|
|
}
|
|
|
|
try {
|
|
const keyInfo = parsePublicKey(publicKey);
|
|
|
|
const response = {
|
|
success: keyInfo.success,
|
|
keyType: keyInfo.keyType,
|
|
detectedKeyType: keyInfo.keyType,
|
|
error: keyInfo.error || null,
|
|
};
|
|
|
|
res.json(response);
|
|
} catch (error) {
|
|
authLogger.error("Failed to detect public key type", error);
|
|
res.status(500).json({
|
|
error:
|
|
error instanceof Error
|
|
? error.message
|
|
: "Failed to detect public key type",
|
|
});
|
|
}
|
|
},
|
|
);
|
|
|
|
// Validate SSH key pair endpoint
|
|
// POST /credentials/validate-key-pair
|
|
router.post(
|
|
"/validate-key-pair",
|
|
authenticateJWT,
|
|
async (req: Request, res: Response) => {
|
|
const { privateKey, publicKey, keyPassword } = req.body;
|
|
|
|
if (!privateKey || typeof privateKey !== "string") {
|
|
return res.status(400).json({ error: "Private key is required" });
|
|
}
|
|
|
|
if (!publicKey || typeof publicKey !== "string") {
|
|
return res.status(400).json({ error: "Public key is required" });
|
|
}
|
|
|
|
try {
|
|
const validationResult = validateKeyPair(
|
|
privateKey,
|
|
publicKey,
|
|
keyPassword,
|
|
);
|
|
|
|
const response = {
|
|
isValid: validationResult.isValid,
|
|
privateKeyType: validationResult.privateKeyType,
|
|
publicKeyType: validationResult.publicKeyType,
|
|
generatedPublicKey: validationResult.generatedPublicKey,
|
|
error: validationResult.error || null,
|
|
};
|
|
|
|
res.json(response);
|
|
} catch (error) {
|
|
authLogger.error("Failed to validate key pair", error);
|
|
res.status(500).json({
|
|
error:
|
|
error instanceof Error
|
|
? error.message
|
|
: "Failed to validate key pair",
|
|
});
|
|
}
|
|
},
|
|
);
|
|
|
|
// Generate new SSH key pair endpoint
|
|
// POST /credentials/generate-key-pair
|
|
router.post(
|
|
"/generate-key-pair",
|
|
authenticateJWT,
|
|
async (req: Request, res: Response) => {
|
|
const { keyType = "ssh-ed25519", keySize = 2048, passphrase } = req.body;
|
|
|
|
try {
|
|
// Generate SSH keys directly with ssh2
|
|
const result = generateSSHKeyPair(keyType, keySize, passphrase);
|
|
|
|
if (result.success && result.privateKey && result.publicKey) {
|
|
const response = {
|
|
success: true,
|
|
privateKey: result.privateKey,
|
|
publicKey: result.publicKey,
|
|
keyType: keyType,
|
|
format: "ssh",
|
|
algorithm: keyType,
|
|
keySize: keyType === "ssh-rsa" ? keySize : undefined,
|
|
curve: keyType === "ecdsa-sha2-nistp256" ? "nistp256" : undefined,
|
|
};
|
|
|
|
res.json(response);
|
|
} else {
|
|
res.status(500).json({
|
|
success: false,
|
|
error: result.error || "Failed to generate SSH key pair",
|
|
});
|
|
}
|
|
} catch (error) {
|
|
authLogger.error("Failed to generate key pair", error);
|
|
res.status(500).json({
|
|
success: false,
|
|
error:
|
|
error instanceof Error
|
|
? error.message
|
|
: "Failed to generate key pair",
|
|
});
|
|
}
|
|
},
|
|
);
|
|
|
|
// Generate public key from private key endpoint
|
|
// POST /credentials/generate-public-key
|
|
router.post(
|
|
"/generate-public-key",
|
|
authenticateJWT,
|
|
async (req: Request, res: Response) => {
|
|
const { privateKey, keyPassword } = req.body;
|
|
|
|
if (!privateKey || typeof privateKey !== "string") {
|
|
return res.status(400).json({ error: "Private key is required" });
|
|
}
|
|
|
|
try {
|
|
// First try to create private key object from the input
|
|
let privateKeyObj;
|
|
let parseAttempts = [];
|
|
|
|
// Attempt 1: Direct parsing with passphrase
|
|
try {
|
|
privateKeyObj = crypto.createPrivateKey({
|
|
key: privateKey,
|
|
passphrase: keyPassword,
|
|
});
|
|
} catch (error) {
|
|
parseAttempts.push(`Method 1 (with passphrase): ${error.message}`);
|
|
}
|
|
|
|
// Attempt 2: Direct parsing without passphrase
|
|
if (!privateKeyObj) {
|
|
try {
|
|
privateKeyObj = crypto.createPrivateKey(privateKey);
|
|
} catch (error) {
|
|
parseAttempts.push(`Method 2 (without passphrase): ${error.message}`);
|
|
}
|
|
}
|
|
|
|
// Attempt 3: Try with explicit format specification
|
|
if (!privateKeyObj) {
|
|
try {
|
|
privateKeyObj = crypto.createPrivateKey({
|
|
key: privateKey,
|
|
format: "pem",
|
|
type: "pkcs8",
|
|
});
|
|
} catch (error) {
|
|
parseAttempts.push(`Method 3 (PKCS#8): ${error.message}`);
|
|
}
|
|
}
|
|
|
|
// Attempt 4: Try as PKCS#1 RSA
|
|
if (
|
|
!privateKeyObj &&
|
|
privateKey.includes("-----BEGIN RSA PRIVATE KEY-----")
|
|
) {
|
|
try {
|
|
privateKeyObj = crypto.createPrivateKey({
|
|
key: privateKey,
|
|
format: "pem",
|
|
type: "pkcs1",
|
|
});
|
|
} catch (error) {
|
|
parseAttempts.push(`Method 4 (PKCS#1): ${error.message}`);
|
|
}
|
|
}
|
|
|
|
// Attempt 5: Try as SEC1 EC
|
|
if (
|
|
!privateKeyObj &&
|
|
privateKey.includes("-----BEGIN EC PRIVATE KEY-----")
|
|
) {
|
|
try {
|
|
privateKeyObj = crypto.createPrivateKey({
|
|
key: privateKey,
|
|
format: "pem",
|
|
type: "sec1",
|
|
});
|
|
} catch (error) {
|
|
parseAttempts.push(`Method 5 (SEC1): ${error.message}`);
|
|
}
|
|
}
|
|
|
|
// Final attempt: Try using ssh2 as fallback
|
|
if (!privateKeyObj) {
|
|
try {
|
|
const keyInfo = parseSSHKey(privateKey, keyPassword);
|
|
|
|
if (keyInfo.success && keyInfo.publicKey) {
|
|
const publicKeyString = String(keyInfo.publicKey);
|
|
return res.json({
|
|
success: true,
|
|
publicKey: publicKeyString,
|
|
keyType: keyInfo.keyType,
|
|
});
|
|
} else {
|
|
parseAttempts.push(
|
|
`SSH2 fallback: ${keyInfo.error || "No public key generated"}`,
|
|
);
|
|
}
|
|
} catch (error) {
|
|
parseAttempts.push(`SSH2 fallback exception: ${error.message}`);
|
|
}
|
|
}
|
|
|
|
if (!privateKeyObj) {
|
|
return res.status(400).json({
|
|
success: false,
|
|
error: "Unable to parse private key. Tried multiple formats.",
|
|
details: parseAttempts,
|
|
});
|
|
}
|
|
|
|
// Generate public key from private key
|
|
const publicKeyObj = crypto.createPublicKey(privateKeyObj);
|
|
const publicKeyPem = publicKeyObj.export({
|
|
type: "spki",
|
|
format: "pem",
|
|
});
|
|
|
|
// Ensure publicKeyPem is a string
|
|
const publicKeyString =
|
|
typeof publicKeyPem === "string"
|
|
? publicKeyPem
|
|
: publicKeyPem.toString("utf8");
|
|
|
|
// Detect key type from the private key object
|
|
let keyType = "unknown";
|
|
const asymmetricKeyType = privateKeyObj.asymmetricKeyType;
|
|
|
|
if (asymmetricKeyType === "rsa") {
|
|
keyType = "ssh-rsa";
|
|
} else if (asymmetricKeyType === "ed25519") {
|
|
keyType = "ssh-ed25519";
|
|
} else if (asymmetricKeyType === "ec") {
|
|
// For EC keys, we need to check the curve
|
|
keyType = "ecdsa-sha2-nistp256"; // Default assumption for P-256
|
|
}
|
|
|
|
// Use ssh2 to generate SSH format public key
|
|
let finalPublicKey = publicKeyString; // PEM fallback
|
|
let formatType = "pem";
|
|
|
|
try {
|
|
const ssh2PrivateKey = ssh2Utils.parseKey(privateKey, keyPassword);
|
|
if (!(ssh2PrivateKey instanceof Error)) {
|
|
const publicKeyBuffer = ssh2PrivateKey.getPublicSSH();
|
|
const base64Data = publicKeyBuffer.toString("base64");
|
|
finalPublicKey = `${keyType} ${base64Data}`;
|
|
formatType = "ssh";
|
|
}
|
|
} catch (sshError) {
|
|
// Use PEM format as fallback
|
|
}
|
|
|
|
const response = {
|
|
success: true,
|
|
publicKey: finalPublicKey,
|
|
keyType: keyType,
|
|
format: formatType,
|
|
};
|
|
|
|
res.json(response);
|
|
} catch (error) {
|
|
authLogger.error("Failed to generate public key", error);
|
|
res.status(500).json({
|
|
success: false,
|
|
error:
|
|
error instanceof Error
|
|
? error.message
|
|
: "Failed to generate public key",
|
|
});
|
|
}
|
|
},
|
|
);
|
|
|
|
// SSH Key Deployment Function
|
|
async function deploySSHKeyToHost(
|
|
hostConfig: any,
|
|
publicKey: string,
|
|
credentialData: any,
|
|
): Promise<{ success: boolean; message?: string; error?: string }> {
|
|
return new Promise((resolve) => {
|
|
const conn = new Client();
|
|
let connectionTimeout: NodeJS.Timeout;
|
|
|
|
// Connection timeout
|
|
connectionTimeout = setTimeout(() => {
|
|
conn.destroy();
|
|
resolve({ success: false, error: "Connection timeout" });
|
|
}, 30000);
|
|
|
|
conn.on("ready", async () => {
|
|
clearTimeout(connectionTimeout);
|
|
|
|
try {
|
|
// Step 1: Create ~/.ssh directory if it doesn't exist
|
|
await new Promise<void>((resolveCmd, rejectCmd) => {
|
|
conn.exec("mkdir -p ~/.ssh && chmod 700 ~/.ssh", (err, stream) => {
|
|
if (err) return rejectCmd(err);
|
|
|
|
stream.on("close", (code) => {
|
|
if (code === 0) {
|
|
resolveCmd();
|
|
} else {
|
|
rejectCmd(new Error(`mkdir command failed with code ${code}`));
|
|
}
|
|
});
|
|
});
|
|
});
|
|
|
|
// Step 2: Check if public key already exists
|
|
const keyExists = await new Promise<boolean>(
|
|
(resolveCheck, rejectCheck) => {
|
|
const keyPattern = publicKey.split(" ")[1]; // Get the key part without algorithm
|
|
conn.exec(
|
|
`grep -q "${keyPattern}" ~/.ssh/authorized_keys 2>/dev/null`,
|
|
(err, stream) => {
|
|
if (err) return rejectCheck(err);
|
|
|
|
stream.on("close", (code) => {
|
|
resolveCheck(code === 0); // code 0 means key found
|
|
});
|
|
},
|
|
);
|
|
},
|
|
);
|
|
|
|
if (keyExists) {
|
|
conn.end();
|
|
resolve({ success: true, message: "SSH key already deployed" });
|
|
return;
|
|
}
|
|
|
|
// Step 3: Add public key to authorized_keys
|
|
await new Promise<void>((resolveAdd, rejectAdd) => {
|
|
const escapedKey = publicKey.replace(/'/g, "'\\''");
|
|
conn.exec(
|
|
`echo '${escapedKey}' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys`,
|
|
(err, stream) => {
|
|
if (err) return rejectAdd(err);
|
|
|
|
stream.on("close", (code) => {
|
|
if (code === 0) {
|
|
resolveAdd();
|
|
} else {
|
|
rejectAdd(
|
|
new Error(`Key deployment failed with code ${code}`),
|
|
);
|
|
}
|
|
});
|
|
},
|
|
);
|
|
});
|
|
|
|
// Step 4: Verify deployment
|
|
const verifySuccess = await new Promise<boolean>(
|
|
(resolveVerify, rejectVerify) => {
|
|
const keyPattern = publicKey.split(" ")[1];
|
|
conn.exec(
|
|
`grep -q "${keyPattern}" ~/.ssh/authorized_keys`,
|
|
(err, stream) => {
|
|
if (err) return rejectVerify(err);
|
|
|
|
stream.on("close", (code) => {
|
|
resolveVerify(code === 0);
|
|
});
|
|
},
|
|
);
|
|
},
|
|
);
|
|
|
|
conn.end();
|
|
|
|
if (verifySuccess) {
|
|
resolve({ success: true, message: "SSH key deployed successfully" });
|
|
} else {
|
|
resolve({
|
|
success: false,
|
|
error: "Key deployment verification failed",
|
|
});
|
|
}
|
|
} catch (error) {
|
|
conn.end();
|
|
resolve({
|
|
success: false,
|
|
error: error instanceof Error ? error.message : "Deployment failed",
|
|
});
|
|
}
|
|
});
|
|
|
|
conn.on("error", (err) => {
|
|
clearTimeout(connectionTimeout);
|
|
resolve({ success: false, error: err.message });
|
|
});
|
|
|
|
// Connect to the target host
|
|
try {
|
|
const connectionConfig: any = {
|
|
host: hostConfig.ip,
|
|
port: hostConfig.port || 22,
|
|
username: hostConfig.username,
|
|
};
|
|
|
|
if (hostConfig.authType === "password" && hostConfig.password) {
|
|
connectionConfig.password = hostConfig.password;
|
|
} else if (hostConfig.authType === "key" && hostConfig.privateKey) {
|
|
connectionConfig.privateKey = hostConfig.privateKey;
|
|
if (hostConfig.keyPassword) {
|
|
connectionConfig.passphrase = hostConfig.keyPassword;
|
|
}
|
|
} else {
|
|
resolve({
|
|
success: false,
|
|
error: "Invalid authentication configuration",
|
|
});
|
|
return;
|
|
}
|
|
|
|
conn.connect(connectionConfig);
|
|
} catch (error) {
|
|
clearTimeout(connectionTimeout);
|
|
resolve({
|
|
success: false,
|
|
error: error instanceof Error ? error.message : "Connection failed",
|
|
});
|
|
}
|
|
});
|
|
}
|
|
|
|
// Deploy SSH Key to Host endpoint
|
|
// POST /credentials/:id/deploy-to-host
|
|
router.post(
|
|
"/:id/deploy-to-host",
|
|
authenticateJWT,
|
|
async (req: Request, res: Response) => {
|
|
const credentialId = parseInt(req.params.id);
|
|
const { targetHostId } = req.body;
|
|
|
|
if (!credentialId || !targetHostId) {
|
|
return res.status(400).json({
|
|
success: false,
|
|
error: "Credential ID and target host ID are required",
|
|
});
|
|
}
|
|
|
|
try {
|
|
// Get credential details
|
|
const credential = await db
|
|
.select()
|
|
.from(sshCredentials)
|
|
.where(eq(sshCredentials.id, credentialId))
|
|
.limit(1);
|
|
|
|
if (!credential || credential.length === 0) {
|
|
return res.status(404).json({
|
|
success: false,
|
|
error: "Credential not found",
|
|
});
|
|
}
|
|
|
|
const credData = credential[0];
|
|
|
|
// Only support key-based credentials for deployment
|
|
if (credData.authType !== "key") {
|
|
return res.status(400).json({
|
|
success: false,
|
|
error: "Only SSH key-based credentials can be deployed",
|
|
});
|
|
}
|
|
|
|
if (!credData.publicKey) {
|
|
return res.status(400).json({
|
|
success: false,
|
|
error: "Public key is required for deployment",
|
|
});
|
|
}
|
|
|
|
// Get target host details
|
|
const targetHost = await db
|
|
.select()
|
|
.from(sshData)
|
|
.where(eq(sshData.id, targetHostId))
|
|
.limit(1);
|
|
|
|
if (!targetHost || targetHost.length === 0) {
|
|
return res.status(404).json({
|
|
success: false,
|
|
error: "Target host not found",
|
|
});
|
|
}
|
|
|
|
const hostData = targetHost[0];
|
|
|
|
// Prepare host configuration for connection
|
|
let hostConfig = {
|
|
ip: hostData.ip,
|
|
port: hostData.port,
|
|
username: hostData.username,
|
|
authType: hostData.authType,
|
|
password: hostData.password,
|
|
privateKey: hostData.key,
|
|
keyPassword: hostData.keyPassword,
|
|
};
|
|
|
|
// If host uses credential authentication, resolve the credential
|
|
if (hostData.authType === "credential" && hostData.credentialId) {
|
|
const hostCredential = await db
|
|
.select()
|
|
.from(sshCredentials)
|
|
.where(eq(sshCredentials.id, hostData.credentialId))
|
|
.limit(1);
|
|
|
|
if (hostCredential && hostCredential.length > 0) {
|
|
const cred = hostCredential[0];
|
|
|
|
// Update hostConfig with credential data
|
|
hostConfig.authType = cred.authType;
|
|
hostConfig.username = cred.username; // Use credential's username
|
|
|
|
if (cred.authType === "password") {
|
|
hostConfig.password = cred.password;
|
|
} else if (cred.authType === "key") {
|
|
hostConfig.privateKey = cred.privateKey || cred.key; // Try both fields
|
|
hostConfig.keyPassword = cred.keyPassword;
|
|
}
|
|
} else {
|
|
return res.status(400).json({
|
|
success: false,
|
|
error: "Host credential not found",
|
|
});
|
|
}
|
|
}
|
|
|
|
// Deploy the SSH key
|
|
const deployResult = await deploySSHKeyToHost(
|
|
hostConfig,
|
|
credData.publicKey,
|
|
credData,
|
|
);
|
|
|
|
if (deployResult.success) {
|
|
// Log successful deployment
|
|
authLogger.info(`SSH key deployed successfully`, {
|
|
credentialId,
|
|
targetHostId,
|
|
operation: "deploy_ssh_key",
|
|
});
|
|
|
|
res.json({
|
|
success: true,
|
|
message: deployResult.message || "SSH key deployed successfully",
|
|
});
|
|
} else {
|
|
authLogger.error(`SSH key deployment failed`, {
|
|
credentialId,
|
|
targetHostId,
|
|
error: deployResult.error,
|
|
operation: "deploy_ssh_key",
|
|
});
|
|
|
|
res.status(500).json({
|
|
success: false,
|
|
error: deployResult.error || "Deployment failed",
|
|
});
|
|
}
|
|
} catch (error) {
|
|
authLogger.error("Failed to deploy SSH key", error);
|
|
res.status(500).json({
|
|
success: false,
|
|
error:
|
|
error instanceof Error ? error.message : "Failed to deploy SSH key",
|
|
});
|
|
}
|
|
},
|
|
);
|
|
|
|
export default router;
|