288 lines
11 KiB
TypeScript
288 lines
11 KiB
TypeScript
import { TRPCError } from "@trpc/server";
|
|
import { z } from "zod/v4";
|
|
|
|
import type { Session } from "@homarr/auth";
|
|
import { hasQueryAccessToIntegrationsAsync } from "@homarr/auth/server";
|
|
import { constructIntegrationPermissions } from "@homarr/auth/shared";
|
|
import { decryptSecret } from "@homarr/common/server";
|
|
import type { AtLeastOneOf } from "@homarr/common/types";
|
|
import type { Database } from "@homarr/db";
|
|
import { and, eq, inArray } from "@homarr/db";
|
|
import { integrations } from "@homarr/db/schema";
|
|
import type { IntegrationKind, WidgetIntegrationKind, WidgetKindWithIntegration } from "@homarr/definitions";
|
|
import { getWidgetIntegrationConfig } from "@homarr/definitions";
|
|
import { createLogger } from "@homarr/core/infrastructure/logs";
|
|
|
|
import { publicProcedure } from "../trpc";
|
|
|
|
export type IntegrationAction = "query" | "interact";
|
|
|
|
const logger = createLogger({ module: "integrationMiddleware" });
|
|
|
|
const getIntegrationKindForLog = (integration: object) => {
|
|
if ("kind" in integration && typeof integration.kind === "string") return integration.kind;
|
|
return "unknown";
|
|
};
|
|
|
|
interface IntegrationAccessMetadata {
|
|
action: IntegrationAction;
|
|
cardinality: "one" | "many";
|
|
userId: string | undefined;
|
|
requestedIntegrationIds: readonly string[];
|
|
allowedIntegrationKinds: readonly IntegrationKind[];
|
|
}
|
|
|
|
const throwUnexpectedIntegrationKind = (kind: IntegrationKind, allowedKinds: readonly IntegrationKind[]): never => {
|
|
logger.error("Database returned an integration outside the requested kinds", {
|
|
integrationKind: kind,
|
|
allowedIntegrationKinds: allowedKinds,
|
|
});
|
|
throw new TRPCError({ code: "INTERNAL_SERVER_ERROR", message: "Integration kind validation failed" });
|
|
};
|
|
|
|
const createOneIntegrationMiddlewareForKinds = <TKind extends IntegrationKind>(
|
|
action: IntegrationAction,
|
|
kinds: readonly TKind[],
|
|
) => {
|
|
return publicProcedure.input(z.object({ integrationId: z.string() })).use(async ({ input, ctx, next }) => {
|
|
const accessMetadata: IntegrationAccessMetadata = {
|
|
action,
|
|
cardinality: "one",
|
|
userId: ctx.session?.user.id,
|
|
requestedIntegrationIds: [input.integrationId],
|
|
allowedIntegrationKinds: kinds,
|
|
};
|
|
logger.debug("Resolving integration access", accessMetadata);
|
|
|
|
const integration = await ctx.db.query.integrations.findFirst({
|
|
where: and(eq(integrations.id, input.integrationId), inArray(integrations.kind, kinds)),
|
|
with: {
|
|
app: true,
|
|
secrets: true,
|
|
groupPermissions: true,
|
|
userPermissions: true,
|
|
items: {
|
|
with: {
|
|
item: true,
|
|
},
|
|
},
|
|
},
|
|
});
|
|
|
|
if (!integration) {
|
|
logger.warn("Integration access target was not found", accessMetadata);
|
|
throw new TRPCError({
|
|
code: "NOT_FOUND",
|
|
message: `Integration with id ${input.integrationId} not found or not of kinds ${kinds.join(",")}`,
|
|
});
|
|
}
|
|
|
|
await throwIfActionIsNotAllowedAsync(action, ctx.db, [integration], ctx.session);
|
|
logger.debug("Integration access granted", {
|
|
...accessMetadata,
|
|
resolvedIntegrationKinds: [integration.kind],
|
|
});
|
|
|
|
const narrowedKind = kinds.find((kind) => kind === integration.kind);
|
|
if (!narrowedKind) {
|
|
return throwUnexpectedIntegrationKind(integration.kind, kinds);
|
|
}
|
|
|
|
const { secrets, items: _ignore1, groupPermissions: _ignore2, userPermissions: _ignore3, ...rest } = integration;
|
|
|
|
return next({
|
|
ctx: {
|
|
integration: {
|
|
...rest,
|
|
externalUrl: rest.app?.href ?? null,
|
|
kind: narrowedKind,
|
|
decryptedSecrets: secrets.map((secret) => ({
|
|
...secret,
|
|
value: decryptSecret(secret.value),
|
|
})),
|
|
},
|
|
},
|
|
});
|
|
});
|
|
};
|
|
|
|
/**
|
|
* Creates a middleware that provides the integration in the context that is of the specified kinds
|
|
* @param action query for showing data or interact for mutating data
|
|
* @param kinds kinds of integrations that are supported
|
|
* @returns middleware that can be used with trpc
|
|
* @example publicProcedure.concat(createOneIntegrationMiddleware("query", "piHole", "homeAssistant")).query(...)
|
|
* @throws TRPCError NOT_FOUND if the integration was not found
|
|
* @throws TRPCError FORBIDDEN if the user does not have permission to perform the specified action on the specified integration
|
|
*/
|
|
export const createOneIntegrationMiddleware = <TKind extends IntegrationKind>(
|
|
action: IntegrationAction,
|
|
...kinds: AtLeastOneOf<TKind> // Ensure at least one kind is provided
|
|
) => {
|
|
return createOneIntegrationMiddlewareForKinds(action, kinds);
|
|
};
|
|
|
|
const createManyIntegrationMiddlewareForKinds = <TKind extends IntegrationKind>(
|
|
action: IntegrationAction,
|
|
kinds: readonly TKind[],
|
|
) => {
|
|
return publicProcedure.input(z.object({ integrationIds: z.array(z.string()) })).use(async ({ ctx, input, next }) => {
|
|
const accessMetadata: IntegrationAccessMetadata = {
|
|
action,
|
|
cardinality: "many",
|
|
userId: ctx.session?.user.id,
|
|
requestedIntegrationIds: input.integrationIds,
|
|
allowedIntegrationKinds: kinds,
|
|
};
|
|
logger.debug("Resolving integration access", accessMetadata);
|
|
|
|
const findIntegrations = async () => {
|
|
if (input.integrationIds.length === 0) return [];
|
|
|
|
return await ctx.db.query.integrations.findMany({
|
|
where: and(inArray(integrations.id, input.integrationIds), inArray(integrations.kind, kinds)),
|
|
with: {
|
|
app: true,
|
|
secrets: true,
|
|
items: {
|
|
with: {
|
|
item: true,
|
|
},
|
|
},
|
|
userPermissions: true,
|
|
groupPermissions: true,
|
|
},
|
|
});
|
|
};
|
|
const dbIntegrations = await findIntegrations();
|
|
|
|
const offset = input.integrationIds.length - dbIntegrations.length;
|
|
if (offset !== 0) {
|
|
logger.warn("Integration access targets were not found", {
|
|
...accessMetadata,
|
|
missingIntegrationCount: offset,
|
|
resolvedIntegrationIds: dbIntegrations.map(({ id }) => id),
|
|
resolvedIntegrationKinds: dbIntegrations.map(({ kind }) => kind),
|
|
});
|
|
throw new TRPCError({
|
|
code: "NOT_FOUND",
|
|
message: `${offset} of the specified integrations not found or not of kinds ${kinds.join(",")}: ([${input.integrationIds.join(",")}] compared to [${dbIntegrations.map(({ id, kind }) => `${kind}:${id}`).join(",")}])`,
|
|
});
|
|
}
|
|
|
|
if (dbIntegrations.length >= 1) {
|
|
await throwIfActionIsNotAllowedAsync(action, ctx.db, dbIntegrations, ctx.session);
|
|
}
|
|
|
|
logger.debug("Integration access granted", {
|
|
...accessMetadata,
|
|
resolvedIntegrationKinds: dbIntegrations.map(({ kind }) => kind),
|
|
});
|
|
|
|
return next({
|
|
ctx: {
|
|
integrations: dbIntegrations.map(
|
|
({ secrets, kind, items: _ignore1, groupPermissions: _ignore2, userPermissions: _ignore3, ...rest }) => {
|
|
const narrowedKind = kinds.find((allowedKind) => allowedKind === kind);
|
|
if (!narrowedKind) return throwUnexpectedIntegrationKind(kind, kinds);
|
|
return {
|
|
...rest,
|
|
externalUrl: rest.app?.href ?? null,
|
|
kind: narrowedKind,
|
|
decryptedSecrets: secrets.map((secret) => ({
|
|
...secret,
|
|
value: decryptSecret(secret.value),
|
|
})),
|
|
};
|
|
},
|
|
),
|
|
},
|
|
});
|
|
});
|
|
};
|
|
|
|
/**
|
|
* Creates a middleware that provides the integrations in the context that are of the specified kinds and have the specified item
|
|
* It also ensures that the user has permission to perform the specified action on the integrations
|
|
* @param action query for showing data or interact for mutating data
|
|
* @param kinds kinds of integrations that are supported
|
|
* @returns middleware that can be used with trpc
|
|
* @example publicProcedure.concat(createManyIntegrationMiddleware("query", "piHole", "homeAssistant")).query(...)
|
|
* @throws TRPCError NOT_FOUND if the integration was not found
|
|
* @throws TRPCError FORBIDDEN if the user does not have permission to perform the specified action on at least one of the specified integrations
|
|
*/
|
|
export const createManyIntegrationMiddleware = <TKind extends IntegrationKind>(
|
|
action: IntegrationAction,
|
|
...kinds: AtLeastOneOf<TKind> // Ensure at least one kind is provided
|
|
) => {
|
|
return createManyIntegrationMiddlewareForKinds(action, kinds);
|
|
};
|
|
|
|
export const createOneWidgetIntegrationMiddleware = <TWidgetKind extends WidgetKindWithIntegration>(
|
|
action: IntegrationAction,
|
|
widgetKind: TWidgetKind,
|
|
): ReturnType<typeof createOneIntegrationMiddlewareForKinds<WidgetIntegrationKind<TWidgetKind>>> =>
|
|
createOneIntegrationMiddlewareForKinds<WidgetIntegrationKind<TWidgetKind>>(
|
|
action,
|
|
getWidgetIntegrationConfig(widgetKind).supportedIntegrations,
|
|
);
|
|
|
|
export const createManyWidgetIntegrationMiddleware = <TWidgetKind extends WidgetKindWithIntegration>(
|
|
action: IntegrationAction,
|
|
widgetKind: TWidgetKind,
|
|
): ReturnType<typeof createManyIntegrationMiddlewareForKinds<WidgetIntegrationKind<TWidgetKind>>> =>
|
|
createManyIntegrationMiddlewareForKinds<WidgetIntegrationKind<TWidgetKind>>(
|
|
action,
|
|
getWidgetIntegrationConfig(widgetKind).supportedIntegrations,
|
|
);
|
|
|
|
/**
|
|
* Throws a TRPCError FORBIDDEN if the user does not have permission to perform the specified action on at least one of the specified integrations
|
|
* @param action action to perform
|
|
* @param db db instance
|
|
* @param integrations integrations to check permissions for
|
|
* @param session session of the user
|
|
* @throws TRPCError FORBIDDEN if the user does not have permission to perform the specified action on at least one of the specified integrations
|
|
*/
|
|
const throwIfActionIsNotAllowedAsync = async (
|
|
action: IntegrationAction,
|
|
db: Database,
|
|
integrationRecords: Parameters<typeof hasQueryAccessToIntegrationsAsync>[1],
|
|
session: Session | null,
|
|
) => {
|
|
if (action === "interact") {
|
|
const haveAllInteractAccess = integrationRecords
|
|
.map((integration) => constructIntegrationPermissions(integration, session))
|
|
.every(({ hasInteractAccess }) => hasInteractAccess);
|
|
if (haveAllInteractAccess) return;
|
|
|
|
logger.warn("Integration access denied", {
|
|
action,
|
|
userId: session?.user.id,
|
|
integrationIds: integrationRecords.map(({ id }) => id),
|
|
integrationKinds: integrationRecords.map(getIntegrationKindForLog),
|
|
});
|
|
|
|
throw new TRPCError({
|
|
code: "FORBIDDEN",
|
|
message: "User does not have permission to interact with at least one of the specified integrations",
|
|
});
|
|
}
|
|
|
|
const hasQueryAccess = await hasQueryAccessToIntegrationsAsync(db, integrationRecords, session);
|
|
|
|
if (hasQueryAccess) return;
|
|
|
|
logger.warn("Integration access denied", {
|
|
action,
|
|
userId: session?.user.id,
|
|
integrationIds: integrationRecords.map(({ id }) => id),
|
|
integrationKinds: integrationRecords.map(getIntegrationKindForLog),
|
|
});
|
|
|
|
throw new TRPCError({
|
|
code: "FORBIDDEN",
|
|
message: "User does not have permission to query at least one of the specified integration",
|
|
});
|
|
};
|