59 lines
1.7 KiB
JavaScript
59 lines
1.7 KiB
JavaScript
'use strict';
|
||
|
||
const crypto = require('crypto');
|
||
const express = require('express');
|
||
const ldapClient = require('./ldapClient');
|
||
const adminSettings = require('./adminSettings');
|
||
|
||
const router = express.Router();
|
||
|
||
function timingSafeEqualStr(a, b) {
|
||
const ba = Buffer.from(String(a || ''));
|
||
const bb = Buffer.from(String(b || ''));
|
||
if (ba.length !== bb.length) return false;
|
||
return crypto.timingSafeEqual(ba, bb);
|
||
}
|
||
|
||
function apiKeyFromRequest(req) {
|
||
const header = String(req.headers['x-api-key'] || '');
|
||
if (header) return header;
|
||
return String(req.query.api_key || '');
|
||
}
|
||
|
||
function requireApiKey(req, res, next) {
|
||
const expected = adminSettings.getSettings().apiKey;
|
||
if (!expected) {
|
||
return res.status(503).json({
|
||
success: false,
|
||
error: 'API-ключ не настроен — сгенерируйте его в панели администратора'
|
||
});
|
||
}
|
||
const provided = apiKeyFromRequest(req);
|
||
if (!provided || !timingSafeEqualStr(provided, expected)) {
|
||
return res.status(401).json({ success: false, error: 'Неверный или отсутствующий API-ключ' });
|
||
}
|
||
next();
|
||
}
|
||
|
||
router.get('/users', requireApiKey, async (req, res) => {
|
||
try {
|
||
const users = await ldapClient.listUsers();
|
||
res.json({
|
||
success: true,
|
||
count: users.length,
|
||
users: users.map((u) => ({
|
||
login: u.login,
|
||
fio: u.full_name,
|
||
position: u.position,
|
||
phone: u.phone,
|
||
email: u.email
|
||
}))
|
||
});
|
||
} catch (err) {
|
||
const status = err.status || 500;
|
||
res.status(status).json({ success: false, error: status >= 500 ? 'Внутренняя ошибка сервера' : (err.message || 'Ошибка') });
|
||
}
|
||
});
|
||
|
||
module.exports = router;
|