277ae6e79c
Implements full role-based access control for mTLS client certificates: - Database: mtls_roles, mtls_certificate_roles, mtls_access_rules tables with migration - Models: CRUD for roles, cert-role assignments, path-based access rules - Caddy config: HTTP-layer RBAC enforcement via CEL fingerprint matching in subroutes - New trust model: select individual certs or entire roles instead of CAs (derives CAs automatically) - REST API: /api/v1/mtls-roles, cert assignments, proxy-host access rules endpoints - UI: Roles management tab (card-based), cert/role trust picker, inline RBAC rule editor - Fix: dialog autoclose bug after creating proxy host (key-based remount) - Tests: 85 new tests (785 total) covering models, schema, RBAC route generation, leaf override, edge cases Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
39 lines
1.2 KiB
TypeScript
39 lines
1.2 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { requireApiAdmin, apiErrorResponse } from "@/src/lib/api-auth";
|
|
import { listMtlsAccessRules, createMtlsAccessRule } from "@/src/lib/models/mtls-access-rules";
|
|
|
|
export async function GET(
|
|
request: NextRequest,
|
|
{ params }: { params: Promise<{ id: string }> }
|
|
) {
|
|
try {
|
|
await requireApiAdmin(request);
|
|
const { id } = await params;
|
|
const rules = await listMtlsAccessRules(Number(id));
|
|
return NextResponse.json(rules);
|
|
} catch (error) {
|
|
return apiErrorResponse(error);
|
|
}
|
|
}
|
|
|
|
export async function POST(
|
|
request: NextRequest,
|
|
{ params }: { params: Promise<{ id: string }> }
|
|
) {
|
|
try {
|
|
const { userId } = await requireApiAdmin(request);
|
|
const { id } = await params;
|
|
const body = await request.json();
|
|
if (!body.path_pattern || typeof body.path_pattern !== "string" || !body.path_pattern.trim()) {
|
|
return NextResponse.json({ error: "path_pattern is required" }, { status: 400 });
|
|
}
|
|
const rule = await createMtlsAccessRule(
|
|
{ ...body, proxy_host_id: Number(id) },
|
|
userId
|
|
);
|
|
return NextResponse.json(rule, { status: 201 });
|
|
} catch (error) {
|
|
return apiErrorResponse(error);
|
|
}
|
|
}
|