Merge branch 'dev' into feat/docker-logs

apps/nextjs/src/app/api/[...trpc]/route.ts

@@ -3,21 +3,24 @@ import { userAgent } from "next/server";
 import { createOpenApiFetchHandler } from "trpc-to-openapi";
 
 import { appRouter, createTRPCContext } from "@homarr/api";
-import type { Session } from "@homarr/auth";
-import { hashPasswordAsync } from "@homarr/auth";
-import { createSessionAsync } from "@homarr/auth/server";
+import { API_KEY_HEADER_NAME, getSessionFromApiKeyAsync } from "@homarr/auth/api-key";
+import { ipAddressFromHeaders } from "@homarr/common/server";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 import { ErrorWithMetadata } from "@homarr/core/infrastructure/logs/error";
-import { db, eq } from "@homarr/db";
-import { apiKeys } from "@homarr/db/schema";
+import { db } from "@homarr/db";
 
 const logger = createLogger({ module: "trpcOpenApiRoute" });
 
 const handlerAsync = async (req: NextRequest) => {
-  const apiKeyHeaderValue = req.headers.get("ApiKey");
-  const ipAddress = req.headers.get("x-forwarded-for");
+  const apiKeyHeaderValue = req.headers.get(API_KEY_HEADER_NAME);
+  const ipAddress = ipAddressFromHeaders(req.headers);
   const { ua } = userAgent(req);
-  const session: Session | null = await getSessionOrDefaultFromHeadersAsync(apiKeyHeaderValue, ipAddress, ua);
+
+  logger.info(
+    `Creating OpenAPI fetch handler for user ${apiKeyHeaderValue ? "with an api key" : "without an api key"}`,
+  );
+
+  const session = await getSessionFromApiKeyAsync(db, apiKeyHeaderValue, ipAddress, ua);
 
   // Fallback to JSON if no content type is set
   if (!req.headers.has("Content-Type")) {
@@ -35,67 +38,6 @@ const handlerAsync = async (req: NextRequest) => {
   });
 };
 
-const getSessionOrDefaultFromHeadersAsync = async (
-  apiKeyHeaderValue: string | null,
-  ipAdress: string | null,
-  userAgent: string,
-): Promise<Session | null> => {
-  logger.info(
-    `Creating OpenAPI fetch handler for user ${apiKeyHeaderValue ? "with an api key" : "without an api key"}`,
-  );
-
-  if (apiKeyHeaderValue === null) {
-    return null;
-  }
-
-  const [apiKeyId, apiKey] = apiKeyHeaderValue.split(".");
-
-  if (!apiKeyId || !apiKey) {
-    logger.warn("An attempt to authenticate over API has failed due to invalid API key format", {
-      ipAdress,
-      userAgent,
-    });
-    return null;
-  }
-
-  const apiKeyFromDb = await db.query.apiKeys.findFirst({
-    where: eq(apiKeys.id, apiKeyId),
-    columns: {
-      id: true,
-      apiKey: true,
-      salt: true,
-    },
-    with: {
-      user: {
-        columns: {
-          id: true,
-          name: true,
-          email: true,
-          emailVerified: true,
-        },
-      },
-    },
-  });
-
-  if (!apiKeyFromDb) {
-    logger.warn("An attempt to authenticate over API has failed", { ipAdress, userAgent });
-    return null;
-  }
-
-  const hashedApiKey = await hashPasswordAsync(apiKey, apiKeyFromDb.salt);
-
-  if (apiKeyFromDb.apiKey !== hashedApiKey) {
-    logger.warn("An attempt to authenticate over API has failed", { ipAdress, userAgent });
-    return null;
-  }
-
-  logger.info("Read session from API request and found user", {
-    name: apiKeyFromDb.user.name,
-    id: apiKeyFromDb.user.id,
-  });
-  return await createSessionAsync(db, apiKeyFromDb.user);
-};
-
 export {
   handlerAsync as DELETE,
   handlerAsync as GET,

apps/nextjs/src/app/api/trpc/[trpc]/route.ts

@@ -1,10 +1,14 @@
+import { userAgent } from "next/server";
 import { fetchRequestHandler } from "@trpc/server/adapters/fetch";
 
 import { appRouter, createTRPCContext } from "@homarr/api";
 import { trpcPath } from "@homarr/api/shared";
+import { API_KEY_HEADER_NAME, getSessionFromApiKeyAsync } from "@homarr/auth/api-key";
 import { auth } from "@homarr/auth/next";
+import { ipAddressFromHeaders } from "@homarr/common/server";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 import { ErrorWithMetadata } from "@homarr/core/infrastructure/logs/error";
+import { db } from "@homarr/db";
 
 const logger = createLogger({ module: "trpcRoute" });
 
@@ -28,11 +32,20 @@ export function OPTIONS() {
 }
 
 const handler = auth(async (req) => {
+  // Try API key auth first, fall back to session cookie
+  const apiKeyHeader = req.headers.get(API_KEY_HEADER_NAME);
+  const ipAddress = ipAddressFromHeaders(req.headers);
+
+  const { ua } = userAgent(req);
+
+  const apiKeySession = await getSessionFromApiKeyAsync(db, apiKeyHeader, ipAddress, ua);
+  const session = apiKeySession ?? req.auth;
+
   const response = await fetchRequestHandler({
     endpoint: trpcPath,
     router: appRouter,
     req,
-    createContext: () => createTRPCContext({ session: req.auth, headers: req.headers }),
+    createContext: () => createTRPCContext({ session, headers: req.headers }),
     onError({ error, path, type }) {
       logger.error(new ErrorWithMetadata("tRPC Error occured", { path, type }, { cause: error }));
     },

apps/nextjs/src/components/access/context.tsx

@@ -1,5 +1,6 @@
 import { createContext, useContext } from "react";
-import type { TablerIcon } from "@tabler/icons-react";
+
+import type { TablerIcon } from "@homarr/ui";
 
 const AccessContext = createContext<{
   permissions: readonly string[];

apps/nextjs/src/components/no-results.tsx

@@ -1,5 +1,6 @@
 import { Anchor, Card, Stack, Text } from "@mantine/core";
-import type { TablerIcon } from "@tabler/icons-react";
+
+import type { TablerIcon } from "@homarr/ui";
 
 interface NoResultsProps {
   icon: TablerIcon;