49 lines
2.2 KiB
JavaScript
49 lines
2.2 KiB
JavaScript
// Node-RED's settings, written by the mesh from the nodered module. What an assignment may change
|
|
// is settings.json beside this file (merged key by key); the credentials are the mesh's secrets and
|
|
// reach Node-RED only through this file. The flows' own credentials stay encrypted in the user
|
|
// directory under the key Node-RED keeps there (.config.runtime.json), which is data, not this.
|
|
const fs = require("fs");
|
|
const path = require("path");
|
|
const crypto = require("crypto");
|
|
|
|
const ADMIN_PASSWORD = "${secret:admin}";
|
|
const API_TOKEN = "${secret:api-token}";
|
|
const ADMIN = { username: "admin", permissions: "*" };
|
|
|
|
const settings = JSON.parse(fs.readFileSync(path.join(__dirname, "settings.json"), "utf8"));
|
|
// The mesh's keys, not Node-RED's: endpoints lands in every merged file; timeZone is the
|
|
// assignment's way to set the zone flows schedule and format in; mqtt names the broker nodes the
|
|
// module's MQTT step keeps pointed at the mesh's broker; topics is what nodered asks the broker for.
|
|
if (settings.timeZone) process.env.TZ = settings.timeZone;
|
|
delete settings.timeZone;
|
|
delete settings.endpoints;
|
|
delete settings.mqtt;
|
|
delete settings.topics;
|
|
|
|
function same(a, b) {
|
|
const x = crypto.createHash("sha256").update(String(a)).digest();
|
|
const y = crypto.createHash("sha256").update(String(b)).digest();
|
|
return crypto.timingSafeEqual(x, y);
|
|
}
|
|
|
|
// The admin secret is a password, or, accepted from an existing install, the bcrypt hash its
|
|
// settings held, so the password people already use keeps working.
|
|
function passwordMatches(given) {
|
|
if (/^\$2[aby]\$\d\d\$/.test(ADMIN_PASSWORD)) return require("bcryptjs").compare(String(given), ADMIN_PASSWORD);
|
|
return Promise.resolve(same(given, ADMIN_PASSWORD));
|
|
}
|
|
|
|
module.exports = Object.assign(settings, {
|
|
uiPort: 1880,
|
|
adminAuth: {
|
|
type: "credentials",
|
|
users: (username) => Promise.resolve(username === ADMIN.username ? ADMIN : null),
|
|
authenticate: (username, password) =>
|
|
username === ADMIN.username
|
|
? passwordMatches(password).then((ok) => (ok ? ADMIN : null))
|
|
: Promise.resolve(null),
|
|
// The module's own tools call the admin API with this bearer token.
|
|
tokens: (token) => Promise.resolve(same(token, API_TOKEN) ? { username: "mesh", permissions: "*" } : null),
|
|
},
|
|
});
|