107 lines
4.1 KiB
TypeScript
107 lines
4.1 KiB
TypeScript
import { createHash } from "node:crypto";
|
|
import { TRPCError } from "@trpc/server";
|
|
|
|
import type { Session } from "@homarr/auth";
|
|
import { decryptSecret } from "@homarr/common/server";
|
|
import {
|
|
getAllTrustedCertificatesAsync,
|
|
getTrustedCertificateHostnamesAsync,
|
|
} from "@homarr/core/infrastructure/certificates";
|
|
import { createCustomCheckServerIdentity } from "@homarr/core/infrastructure/http";
|
|
import type { Database } from "@homarr/db";
|
|
import { eq } from "@homarr/db";
|
|
import { integrations } from "@homarr/db/schema";
|
|
import type { CustomJsxRequest, CustomWidgetSource } from "@homarr/custom-widgets/core";
|
|
import { getCustomWidgetSourceAuthType } from "@homarr/custom-widgets/core";
|
|
import type { CustomWidgetHttpRequest } from "@homarr/custom-widgets/server";
|
|
import { getCustomWidgetIntegrationConnection } from "@homarr/integrations/custom-widget-source";
|
|
|
|
import { throwIfActionForbiddenAsync } from "../integration/integration-access";
|
|
|
|
interface SourceContext {
|
|
db: Database;
|
|
session: Session | null;
|
|
}
|
|
|
|
export async function assertCustomWidgetIntegrationBindings(
|
|
ctx: SourceContext,
|
|
sources: Record<string, CustomWidgetSource>,
|
|
) {
|
|
for (const source of Object.values(sources)) {
|
|
if (source.type !== "integration" || !source.integrationId) continue;
|
|
await resolveIntegration(ctx, source, "full");
|
|
}
|
|
}
|
|
|
|
async function resolveIntegration(
|
|
ctx: SourceContext,
|
|
source: Extract<CustomWidgetSource, { type: "integration" }>,
|
|
permission: "use" | "interact" | "full",
|
|
) {
|
|
if (!source.integrationId) {
|
|
throw new TRPCError({
|
|
code: "PRECONDITION_FAILED",
|
|
message: "Select an existing integration for this widget source",
|
|
});
|
|
}
|
|
await throwIfActionForbiddenAsync(ctx, eq(integrations.id, source.integrationId), permission);
|
|
const integration = await ctx.db.query.integrations.findFirst({
|
|
where: eq(integrations.id, source.integrationId),
|
|
with: { secrets: true },
|
|
});
|
|
if (!integration || integration.kind !== source.integrationKind) {
|
|
throw new TRPCError({
|
|
code: "PRECONDITION_FAILED",
|
|
message: "The selected integration is unavailable or has a different type",
|
|
});
|
|
}
|
|
return integration;
|
|
}
|
|
|
|
export async function resolveCustomWidgetSource(
|
|
ctx: SourceContext,
|
|
source: CustomWidgetSource,
|
|
request: Pick<CustomJsxRequest, "kind" | "method" | "auth">,
|
|
getSecrets: () => Array<{ kind: string; value: string }>,
|
|
): Promise<
|
|
Pick<CustomWidgetHttpRequest, "baseUrl" | "networkScope" | "auth" | "tls" | "pathPrefix"> & { cacheVersion: string }
|
|
> {
|
|
if (source.type !== "integration") {
|
|
const authType = getCustomWidgetSourceAuthType(source);
|
|
let auth: CustomWidgetHttpRequest["auth"];
|
|
if (request.auth !== "none" && authType !== "none") {
|
|
auth = { type: authType, secrets: getSecrets() };
|
|
if (typeof source.auth === "object") auth.headerName = source.auth.name;
|
|
}
|
|
return { baseUrl: source.baseUrl, networkScope: source.networkScope, auth, cacheVersion: "" };
|
|
}
|
|
let permission = "use" as "use" | "interact" | "full";
|
|
if (request.kind === "action" || request.method !== "GET") permission = "interact";
|
|
if (request.method === "DELETE") permission = "full";
|
|
const integration = await resolveIntegration(ctx, source, permission);
|
|
const connection = getCustomWidgetIntegrationConnection({
|
|
...integration,
|
|
externalUrl: null,
|
|
decryptedSecrets: integration.secrets.map(({ kind, value }) => ({ kind, value: decryptSecret(value) })),
|
|
});
|
|
let tls: CustomWidgetHttpRequest["tls"];
|
|
if (new URL(connection.baseUrl).protocol === "https:") {
|
|
const [ca, hostnames] = await Promise.all([
|
|
getAllTrustedCertificatesAsync(),
|
|
getTrustedCertificateHostnamesAsync(),
|
|
]);
|
|
tls = { ca, checkServerIdentity: createCustomCheckServerIdentity(hostnames) };
|
|
}
|
|
return {
|
|
...connection,
|
|
auth: request.auth === "none" ? undefined : connection.auth,
|
|
networkScope: "loopback",
|
|
pathPrefix: new URL(connection.baseUrl).pathname,
|
|
tls,
|
|
cacheVersion: createHash("sha256")
|
|
.update(JSON.stringify([integration.id, integration.kind, integration.url, integration.secrets]))
|
|
.digest("hex")
|
|
.slice(0, 16),
|
|
};
|
|
}
|