refactor(desloppify): SSO login-page route, CLAUDE.md rewrite, gitignore cleanup

- sso-gate.js: add GET /api/v1/auth/login-page?service= route; auto-login HTML for chat/plex/jellyfin/emby now served from code instead of inline Caddyfile respond blobs. Fix merge() try-block syntax error (was missing closing } before catch, breaking Jellyfin/Emby localStorage merge). - middleware.js: add /api/v1/auth/login-page to PUBLIC_ROUTES. - CLAUDE.md: complete rewrite — was describing the old Windows-local C:/caddy/ layout; now accurately describes DNS2 production (paths, container, caddy-apply workflow, SSO architecture, common mistakes). - .gitignore: cover runtime JSON/log/cert files that were sitting untracked in dev root (audit-log, backup-history, credentials, health-history, etc.), plus generated-certs/, pki/, assets/. - Remove tracked dev-root noise: comprehensive-test.js, license-keygen.js, test-security-fixes.js (scripts that don't belong at repo root). - Remove stale routes/openclaw.js (leftover from old monolithic structure). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-28 03:48:11 -07:00
parent 5f6c25d2e3
commit a2e6566958
5 changed files with 196 additions and 486 deletions
@@ -196,5 +196,73 @@ module.exports = function(deps) {
    }
  }, 'auth-app-token'));

+  // Serve service-specific auto-login page (auth enforced by Caddy forward_auth upstream)
+  router.get('/auth/login-page', (req, res) => {
+    const service = (req.query.service || '').replace(/[^a-z]/g, '');
+    const html = buildLoginPage(service);
+    if (!html) return res.status(404).send('Unknown service');
+    res.setHeader('Content-Type', 'text/html; charset=utf-8');
+    res.setHeader('Cache-Control', 'no-store');
+    res.send(html);
+  });
+
  return router;
 };
+
+function buildLoginPage(service) {
+  const SHELL = (body) => `<!DOCTYPE html>
+<html><head><meta charset="utf-8"><title>__TITLE__</title>
+<style>body{background:__BG__;color:#e0e0e0;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;gap:12px}a{color:__ACCENT__}#d{font-size:12px;color:#888;max-width:80vw;overflow:auto;white-space:pre-wrap}</style>
+</head><body><p id="m">__TITLE__</p><div id="d"></div>
+<script>(function(){
+var ls=localStorage,d=document.getElementById('d'),m=document.getElementById('m');
+function go(u){setTimeout(function(){location.replace(u)},300)}
+function fail(msg,info){m.innerHTML=msg;d.textContent=info||''}
+function ft(svc){return fetch('/dashcaddy-api/api/auth/app-token/'+svc,{credentials:'include'})}
+function merge(ck,j,name){try{var c=JSON.parse(ls.getItem(ck)||'{}');if(c.Servers&&c.Servers.length){var s=c.Servers[0];s.AccessToken=j.token;s.UserId=j.userId||s.UserId||'';s.DateLastAccessed=Date.now();ls.setItem(ck,JSON.stringify(c));return}}catch(e){}ls.setItem(ck,JSON.stringify({Servers:[{Id:j.serverId||'',Name:j.serverName||name,UserId:j.userId||'',AccessToken:j.token,ManualAddress:location.origin,LastConnectionMode:2,DateLastAccessed:Date.now()}]}))}
+${body}
+})()</script></body></html>`;
+
+  const pages = {
+    chat: {
+      title: 'Signing in...', bg: '#0a0a0a', accent: '#60a5fa',
+      body: `if(ls.getItem('token')){go('/?direct=1');return}
+d.textContent='Fetching token from DashCaddy...';
+ft('chat').then(function(r){d.textContent+='  Status: '+r.status;return r.text()}).then(function(t){
+  d.textContent+='\\n'+t.substring(0,300);
+  try{var j=JSON.parse(t);if(j.token){ls.setItem('token',j.token);go('/?direct=1')}
+  else{fail('Auto-login unavailable. <a href="/auth?nologin=1">Sign in manually</a>','No token field in response')}}
+  catch(e){fail('Auto-login error. <a href="/auth?nologin=1">Sign in manually</a>','Parse error: '+e.message)}
+}).catch(function(e){fail('Could not reach DashCaddy. <a href="/auth?nologin=1">Sign in manually</a>','Fetch error: '+e.message)})`
+    },
+    plex: {
+      title: 'Signing in to Plex...', bg: '#1f1f1f', accent: '#e5a00d',
+      body: `if(ls.getItem('myPlexAccessToken')){go('/web/?direct=1');return}
+ft('plex').then(function(r){return r.json()}).then(function(j){
+  if(j.token){ls.setItem('myPlexAccessToken',j.token);d.textContent='Token stored, redirecting...';go('/web/?direct=1')}
+  else{fail('Auto-login unavailable. <a href="/web/?direct=1">Open Plex manually</a>',JSON.stringify(j))}
+}).catch(function(e){fail('Could not reach DashCaddy. <a href="/web/?direct=1">Open Plex manually</a>','Error: '+e.message)})`
+    },
+    jellyfin: {
+      title: 'Signing in to Jellyfin...', bg: '#101014', accent: '#00a4dc',
+      body: `ft('jellyfin').then(function(r){return r.json()}).then(function(j){
+  if(j.token){merge('jellyfin_credentials',j,'Jellyfin');merge('_jellyfin_credentials',j,'Jellyfin');d.textContent='Token stored, redirecting...';go('/web/')}
+  else{fail('Auto-login unavailable. <a href="/web/">Open Jellyfin manually</a>',JSON.stringify(j))}
+}).catch(function(e){fail('Could not reach DashCaddy. <a href="/web/">Open Jellyfin manually</a>','Error: '+e.message)})`
+    },
+    emby: {
+      title: 'Signing in to Emby...', bg: '#101014', accent: '#52b54b',
+      body: `ft('emby').then(function(r){return r.json()}).then(function(j){
+  if(j.token){merge('emby_credentials',j,'Emby');merge('_emby_credentials',j,'Emby');d.textContent='Token stored, redirecting...';go('/web/')}
+  else{fail('Auto-login unavailable. <a href="/web/">Open Emby manually</a>',JSON.stringify(j))}
+}).catch(function(e){fail('Could not reach DashCaddy. <a href="/web/">Open Emby manually</a>','Error: '+e.message)})`
+    },
+  };
+
+  const cfg = pages[service];
+  if (!cfg) return null;
+  return SHELL(cfg.body)
+    .replace(/__TITLE__/g, cfg.title)
+    .replace('__BG__', cfg.bg)
+    .replace('__ACCENT__', cfg.accent);
+}