refactor: permissions system rewrite

.gitignore

@@ -51,6 +51,7 @@ typings/
 
 # Visual Studio Code workspace
 .vscode/sftp.json
+.history/
 
 # OSX
 .DS_Store

api/.env.development

@@ -1,5 +1,6 @@
 PATHS_UNRAID_DATA=./dev/data # Where we store plugin data (e.g. permissions.json)
 PATHS_STATES=./dev/states # Where .ini files live (e.g. vars.ini)
+PATHS_AUTH_KEY=./dev/keys # Auth key directory
 PATHS_DYNAMIX_BASE=./dev/dynamix # Dynamix's data directory
 PATHS_DYNAMIX_CONFIG_DEFAULT=./dev/dynamix/default.cfg # Dynamix's default config file, which ships with unraid
 PATHS_DYNAMIX_CONFIG=./dev/dynamix/dynamix.cfg # Dynamix's config file

api/dev/keys/10f356da-1e9e-43b8-9028-a26a645539a6.json

@@ -0,0 +1,8 @@
+{
+    "id": "10f356da-1e9e-43b8-9028-a26a645539a6",
+    "key": "73717ca0-8c15-40b9-bcca-8d85656d1438",
+    "name": "Test API Key",
+    "description": "Testing API key creation",
+    "roles": ["guest", "upc"],
+    "createdAt": "2024-10-29T19:59:12.569Z"
+}

api/package.json

@@ -55,6 +55,7 @@
     "@nestjs/passport": "^10.0.3",
     "@nestjs/platform-fastify": "^10.4.7",
     "@nestjs/schedule": "^4.1.1",
+    "@nestjs/throttler": "^6.2.1",
     "@reduxjs/toolkit": "^2.3.0",
     "@reflet/cron": "^1.3.1",
     "@runonflux/nat-upnp": "^1.0.2",
@@ -64,6 +65,7 @@
     "bytes": "^3.1.2",
     "cacheable-lookup": "^7.0.0",
     "camelcase-keys": "^9.1.3",
+    "casbin": "^5.32.0",
     "catch-exit": "^1.2.2",
     "chokidar": "^4.0.1",
     "cli-table": "^0.3.11",

api/src/__test__/core/utils/files/config-file-normalizer.test.ts

@@ -1,9 +1,10 @@
 import 'reflect-metadata';
 
-import { test, expect } from 'vitest';
+import { cloneDeep } from 'lodash-es';
+import { expect, test } from 'vitest';
+
 import { getWriteableConfig } from '@app/core/utils/files/config-file-normalizer';
 import { initialState } from '@app/store/modules/config';
-import { cloneDeep } from 'lodash-es';
 
 test('it creates a FLASH config with NO OPTIONAL values', () => {
     const basicConfig = initialState;
@@ -25,6 +26,7 @@ test('it creates a FLASH config with NO OPTIONAL values', () => {
 		    "dynamicRemoteAccessType": "DISABLED",
 		    "email": "",
 		    "idtoken": "",
+		    "localApiKey": "",
 		    "refreshtoken": "",
 		    "regWizTime": "",
 		    "username": "",
@@ -62,6 +64,7 @@ test('it creates a MEMORY config with NO OPTIONAL values', () => {
 		    "dynamicRemoteAccessType": "DISABLED",
 		    "email": "",
 		    "idtoken": "",
+		    "localApiKey": "",
 		    "refreshtoken": "",
 		    "regWizTime": "",
 		    "username": "",
@@ -105,6 +108,7 @@ test('it creates a FLASH config with OPTIONAL values', () => {
 		    "dynamicRemoteAccessType": "DISABLED",
 		    "email": "",
 		    "idtoken": "",
+		    "localApiKey": "",
 		    "refreshtoken": "",
 		    "regWizTime": "",
 		    "upnpEnabled": "yes",
@@ -154,6 +158,7 @@ test('it creates a MEMORY config with OPTIONAL values', () => {
 		    "dynamicRemoteAccessType": "DISABLED",
 		    "email": "",
 		    "idtoken": "",
+		    "localApiKey": "",
 		    "refreshtoken": "",
 		    "regWizTime": "",
 		    "upnpEnabled": "yes",

api/src/__test__/store/modules/config.test.ts

@@ -1,4 +1,5 @@
-import { test, expect } from 'vitest';
+import { expect, test } from 'vitest';
+
 import { store } from '@app/store';
 
 test('Before init returns default values for all fields', async () => {
@@ -30,6 +31,7 @@ test('Before init returns default values for all fields', async () => {
 		    "dynamicRemoteAccessType": "DISABLED",
 		    "email": "",
 		    "idtoken": "",
+		    "localApiKey": "",
 		    "refreshtoken": "",
 		    "regWizTime": "",
 		    "upnpEnabled": "",
@@ -80,6 +82,7 @@ test('After init returns values from cfg file for all fields', async () => {
                 dynamicRemoteAccessType: 'DISABLED',
                 email: 'test@example.com',
                 idtoken: '',
+                localApiKey: '',
                 refreshtoken: '',
                 regWizTime: '1611175408732_0951-1653-3509-FBA155FA23C0',
                 upnpEnabled: 'no',
@@ -96,9 +99,7 @@ test('After init returns values from cfg file for all fields', async () => {
 });
 
 test('updateUserConfig merges in changes to current state', async () => {
-    const { loadConfigFile, updateUserConfig } = await import(
-        '@app/store/modules/config'
-    );
+    const { loadConfigFile, updateUserConfig } = await import('@app/store/modules/config');
 
     // Load cfg into store
     await store.dispatch(loadConfigFile());
@@ -138,6 +139,7 @@ test('updateUserConfig merges in changes to current state', async () => {
                 dynamicRemoteAccessType: 'DISABLED',
                 email: 'test@example.com',
                 idtoken: '',
+                localApiKey: '',
                 refreshtoken: '',
                 regWizTime: '1611175408732_0951-1653-3509-FBA155FA23C0',
                 upnpEnabled: 'no',

api/src/__test__/store/modules/paths.test.ts

@@ -2,8 +2,8 @@ import { expect, test } from 'vitest';
 import { store } from '@app/store';
 
 test('Returns paths', async () => {
-	const { paths } = store.getState();
-	expect(Object.keys(paths)).toMatchInlineSnapshot(`
+    const { paths } = store.getState();
+    expect(Object.keys(paths)).toMatchInlineSnapshot(`
 		[
 		  "core",
 		  "unraid-api-base",
@@ -26,6 +26,7 @@ test('Returns paths', async () => {
 		  "log-base",
 		  "var-run",
 		  "auth-sessions",
+		  "auth-keys",
 		]
 	`);
 });

api/src/cli/commands/report.ts

@@ -1,22 +1,21 @@
-import ipRegex from 'ip-regex';
+import { stdout } from 'process';
 import readLine from 'readline';
+
+import { ApolloClient, ApolloQueryResult, NormalizedCacheObject } from '@apollo/client/core/index.js';
+import ipRegex from 'ip-regex';
+
 import { setEnv } from '@app/cli/set-env';
-import { isUnraidApiRunning } from '@app/core/utils/pm2/unraid-api-running';
 import { cliLogger } from '@app/core/log';
+import { isUnraidApiRunning } from '@app/core/utils/pm2/unraid-api-running';
+import { API_VERSION } from '@app/environment';
+import { MinigraphStatus } from '@app/graphql/generated/api/types';
 import { getters, store } from '@app/store';
-import { stdout } from 'process';
 import { loadConfigFile } from '@app/store/modules/config';
-import { getApiApolloClient } from '../../graphql/client/api/get-api-client';
-import {
-    getCloudDocument,
-    getServersDocument,
-    type getServersQuery,
-    type getCloudQuery,
-} from '../../graphql/generated/api/operations';
-import { MinigraphStatus } from '@app/graphql/generated/api/types';
-import { API_VERSION } from '@app/environment';
 import { loadStateFiles } from '@app/store/modules/emhttp';
-import { ApolloClient, ApolloQueryResult, NormalizedCacheObject } from '@apollo/client/core/index.js';
+
+import type { getCloudQuery, getServersQuery } from '../../graphql/generated/api/operations';
+import { getApiApolloClient } from '../../graphql/client/api/get-api-client';
+import { getCloudDocument, getServersDocument } from '../../graphql/generated/api/operations';
 
 type CloudQueryResult = NonNullable<ApolloQueryResult<getCloudQuery>['data']['cloud']>;
 type ServersQueryResultServer = NonNullable<ApolloQueryResult<getServersQuery>['data']['servers']>[0];
@@ -263,7 +262,7 @@ export const report = async (...argv: string[]) => {
         const { config, emhttp } = store.getState();
         if (!config.upc.apikey) throw new Error('Missing UPC API key');
 
-        const client = getApiApolloClient({ upcApiKey: config.upc.apikey });
+        const client = getApiApolloClient({ localApiKey: config.remote.localApiKey || '' });
         // Fetch the cloud endpoint
         const cloud = await getCloudData(client);
 
@@ -288,7 +287,7 @@ export const report = async (...argv: string[]) => {
                 environment: process.env.ENVIRONMENT ?? 'THIS_WILL_BE_REPLACED_WHEN_BUILT',
                 nodeVersion: process.version,
             },
-            apiKey: isApiKeyValid ? 'valid' : cloud?.apiKey.error ?? 'invalid',
+            apiKey: isApiKeyValid ? 'valid' : (cloud?.apiKey.error ?? 'invalid'),
             ...(servers ? { servers } : {}),
             myServers: {
                 status: config?.remote?.username ? 'authenticated' : 'signed out',
@@ -304,7 +303,7 @@ export const report = async (...argv: string[]) => {
                 status: cloud?.minigraphql.status ?? MinigraphStatus.PRE_INIT,
                 timeout: cloud?.minigraphql.timeout ?? null,
                 error:
-                    cloud?.minigraphql.error ?? !cloud?.minigraphql.status ? 'API Disconnected' : null,
+                    (cloud?.minigraphql.error ?? !cloud?.minigraphql.status) ? 'API Disconnected' : null,
             },
             cloud: {
                 status: cloud?.cloud.status ?? 'error',

api/src/core/utils/files/config-file-normalizer.ts

@@ -51,6 +51,7 @@ export const getWriteableConfig = <T extends ConfigType>(
             wanport: remote.wanport ?? initialState.remote.wanport,
             ...(remote.upnpEnabled ? { upnpEnabled: remote.upnpEnabled } : {}),
             apikey: remote.apikey ?? initialState.remote.apikey,
+            localApiKey: remote.localApiKey ?? initialState.remote.localApiKey,
             email: remote.email ?? initialState.remote.email,
             username: remote.username ?? initialState.remote.username,
             avatar: remote.avatar ?? initialState.remote.avatar,