sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

[grade=pending] QA sprint: commit 103 at-risk files from multi-agent sprint work

Browse Source 
Committed by Hermes autonomous QA sprint 2026-08-13.
These files were modified during the Aug 12 sprint but never committed.
This commit is contained in:
Krystie
2026-08-12 17:34:10 -07:00
parent 0bf4406253
commit 503de258b8
105 changed files with 14057 additions and 2632 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dashcaddy-api/src/utilities/middleware.js
+62 -36
View File
@@ -113,6 +113,41 @@ module.exports = function configureMiddleware(app, {
next();
});
// ── Tailscale authentication helpers ──
const PROBE_PATHS_TAILSCALE = new Set([
'/health', '/health/live', '/health/ready', '/healthz', '/readyz',
]);
function isTailScaleProbePath(reqPath) {
return PROBE_PATHS_TAILSCALE.has(reqPath) || reqPath.startsWith('/probe/');
}
function extractTailscaleIPs(req) {
const clientIP = req.ip || req.socket?.remoteAddress || '';
const forwardedFor = req.headers['x-forwarded-for'];
const realIP = req.headers['x-real-ip'];
const ipsToCheck = [clientIP, forwardedFor, realIP].filter(Boolean);
const fromTailscale = ipsToCheck.some(ip =>
isTailscaleIP(ip.toString().split(',')[0].trim()));
const clientTailscaleIP = ipsToCheck
.map(ip => ip.toString().split(',')[0].trim())
.find(ip => isTailscaleIP(ip));
return { clientIP, ipsToCheck, fromTailscale, clientTailscaleIP };
}
async function isIPInTailnet(clientTailscaleIP) {
const status = await getTailscaleStatus();
if (!status) return true; // no status = can't verify = allow
const knownIPs = new Set();
for (const ip of (status.Self?.TailscaleIPs || [])) knownIPs.add(ip);
for (const peer of Object.values(status.Peer || {})) {
for (const ip of (peer.TailscaleIPs || [])) knownIPs.add(ip);
}
return knownIPs.has(clientTailscaleIP);
}
// ── Tailscale authentication middleware (optional) ──
const tailscaleAuthMiddleware = async (req, res, next) => {
if (!tailscaleConfig.enabled || !tailscaleConfig.requireAuth) {
@@ -121,25 +156,11 @@ module.exports = function configureMiddleware(app, {
// Probe endpoints bypass Tailscale auth — k8s/Docker healthchecks
// don't carry a Tailscale identity header.
if (req.path === '/health'
|| req.path === '/health/live'
|| req.path === '/health/ready'
|| req.path === '/healthz'
|| req.path === '/readyz'
|| req.path.startsWith('/probe/')) {
if (isTailScaleProbePath(req.path) || req.path.startsWith('/api/v1/tailscale/')) {
return next();
}
if (req.path.startsWith('/api/v1/tailscale/')) {
return next();
}
const clientIP = req.ip || req.socket?.remoteAddress || '';
const forwardedFor = req.headers['x-forwarded-for'];
const realIP = req.headers['x-real-ip'];
const ipsToCheck = [clientIP, forwardedFor, realIP].filter(Boolean);
const fromTailscale = ipsToCheck.some(ip => isTailscaleIP(ip.toString().split(',')[0].trim()));
const { clientIP, fromTailscale, clientTailscaleIP } = extractTailscaleIPs(req);
if (!fromTailscale) {
return errorResponse(res, 403, '[DC-120] Access denied. This dashboard requires Tailscale connection.', {
@@ -148,27 +169,14 @@ module.exports = function configureMiddleware(app, {
});
}
if (tailscaleConfig.allowedTailnet) {
if (tailscaleConfig.allowedTailnet && clientTailscaleIP) {
try {
const status = await getTailscaleStatus();
if (status) {
const clientTailscaleIP = ipsToCheck
.map(ip => ip.toString().split(',')[0].trim())
.find(ip => isTailscaleIP(ip));
if (clientTailscaleIP) {
const knownIPs = new Set();
for (const ip of (status.Self?.TailscaleIPs || [])) knownIPs.add(ip);
for (const peer of Object.values(status.Peer || {})) {
for (const ip of (peer.TailscaleIPs || [])) knownIPs.add(ip);
}
if (!knownIPs.has(clientTailscaleIP)) {
return errorResponse(res, 403, '[DC-121] Access denied. Device not in allowed tailnet.', {
requiresTailscale: true,
clientIP
});
}
}
const inTailnet = await isIPInTailnet(clientTailscaleIP);
if (!inTailnet) {
return errorResponse(res, 403, '[DC-121] Access denied. Device not in allowed tailnet.', {
requiresTailscale: true,
clientIP
});
}
} catch (e) {
log.warn('tailscale', 'Tailnet verification failed, allowing request', { error: e.message });
@@ -429,6 +437,12 @@ module.exports = function configureMiddleware(app, {
{ path: '/api/v1/config', exact: true, method: 'GET' },
{ path: '/api/v1/services/status', exact: true, method: 'GET' },
{ path: '/api/v1/health-checks/status', exact: true, method: 'GET' },
// DC-075: System health endpoint for external uptime monitoring (UptimeRobot, BetterStack)
{ path: '/api/v1/system/health', exact: true, method: 'GET' },
// DC-097: Prometheus metrics endpoint (scraped by Prometheus, no auth)
{ path: '/api/v1/metrics/prometheus', exact: true, method: 'GET' },
// DC-077: i18n endpoints (language list + translations, public)
{ path: '/api/v1/i18n/', prefix: true, method: 'GET' },
// System Overview widget on the dashboard — needs the flattened CPU/mem
// data without going through auth. See skill references/totp-and-system-overview-pitfalls.md §3.
{ path: '/api/v1/monitoring/stats', exact: true, method: 'GET' },
@@ -561,6 +575,18 @@ module.exports = function configureMiddleware(app, {
});
app.use(generalLimiter);
// ── DC-073: Debug request logger (gated behind LOG_LEVEL=debug) ──
if (process.env.LOG_LEVEL === 'debug') {
app.use((req, res, next) => {
const start = Date.now();
res.on('finish', () => {
const duration = Date.now() - start;
process.stderr.write(`[req] ${req.method} ${req.path} ${res.statusCode} ${duration}ms\n`);
});
next();
});
}
app.use('/api/v1/dns/credentials', strictLimiter);
app.use('/api/v1/apps/deploy', strictLimiter);
app.use('/api/v1/backup/restore', strictLimiter);