52 lines
1.8 KiB
TypeScript
52 lines
1.8 KiB
TypeScript
import { configManager } from '@/lib/admin/config-manager';
|
|
|
|
export interface ImpersonationConfig {
|
|
jwtSecret: string;
|
|
masterUser: string;
|
|
masterPassword: string;
|
|
expectedIssuer: string;
|
|
}
|
|
|
|
/**
|
|
* Returns null when impersonation is not configured - the route MUST surface
|
|
* that as a 404 so an unconfigured deployment doesn't expose the endpoint.
|
|
*
|
|
* Required env:
|
|
* BULWARK_JWT_AUTH_SECRET (>= 32 chars)
|
|
* BULWARK_STALWART_MASTER_USER master account address (e.g. master@example.com)
|
|
* BULWARK_STALWART_MASTER_PASSWORD
|
|
*
|
|
* Optional env:
|
|
* BULWARK_JWT_AUTH_ISSUER (default: "platform-api/webmail")
|
|
*/
|
|
export function readImpersonationConfig(): ImpersonationConfig | null {
|
|
const jwtSecret = process.env.BULWARK_JWT_AUTH_SECRET ?? '';
|
|
const masterUser = process.env.BULWARK_STALWART_MASTER_USER ?? '';
|
|
const masterPassword = process.env.BULWARK_STALWART_MASTER_PASSWORD ?? '';
|
|
if (!jwtSecret || !masterUser || !masterPassword) return null;
|
|
return {
|
|
jwtSecret,
|
|
masterUser,
|
|
masterPassword,
|
|
expectedIssuer: process.env.BULWARK_JWT_AUTH_ISSUER ?? 'platform-api/webmail',
|
|
};
|
|
}
|
|
|
|
/**
|
|
* Resolves the upstream JMAP server URL the same way /api/auth/session does
|
|
* for trusted entries: the global `jmapServerUrl` admin setting, then the
|
|
* legacy env fallbacks. Returns null if none is configured.
|
|
*
|
|
* The impersonation flow is server-to-server (no user input), so we never
|
|
* accept a custom endpoint - only admin-configured URLs.
|
|
*/
|
|
export async function resolveImpersonationServerUrl(): Promise<string | null> {
|
|
await configManager.ensureLoaded();
|
|
const url =
|
|
configManager.get<string>('jmapServerUrl', '') ||
|
|
process.env.JMAP_SERVER_URL ||
|
|
process.env.NEXT_PUBLIC_JMAP_SERVER_URL ||
|
|
'';
|
|
return url || null;
|
|
}
|