lorentz
a4242b81be
Duo API Client (lib/services/duo-client.ts): - HMAC-SHA1 request signing, GET/POST, automatic pagination - Rate-limit handling (429 + Retry-After), configurable timeout - Accounts API: listAccounts() via POST /accounts/v1/account/list - Admin API: getUsers, getPhones, getGroups, getIntegrations, getAuthLogs - Child account access: parent creds signed against child api_hostname + account_id - Factory helpers: getDuoAccountsClient(), getDuoAdminClient() Database (migration 058): - 6 tables: duo_accounts, duo_users, duo_phones, duo_auth_logs, duo_groups, duo_integrations - All with proper FKs, indexes, JSONB fields for capabilities/location/groups Sync Service (lib/services/duo-sync-service.ts): - syncAll(): accounts → per-child data + auth logs → parent account → company matching - Sequential child processing to respect rate limits - Incremental auth logs (mintime = last synced timestamp, default 30 days) - Company matching: exact → case-insensitive containment (30/32 = 94% matched) - Non-blocking with sync ID tracking API Routes: - POST/GET /api/duo/sync — trigger sync / check status - GET /api/duo/accounts — list all accounts with stats + matched company - GET /api/duo/accounts/[id]/users — users for a specific account - POST /api/openclaw/sync/duo — OpenClaw trigger with API key auth Results: 33 accounts, 832 users, 925 phones, 5927 auth logs, 46 groups, 78 integrations
94 lines
2.6 KiB
TypeScript
94 lines
2.6 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import type { NextRequest } from "next/server";
|
|
import { getSessionCookie } from "better-auth/cookies";
|
|
|
|
// Routes that don't require authentication
|
|
const publicRoutes = [
|
|
"/auth/sign-in",
|
|
"/auth/verify",
|
|
"/auth/2fa",
|
|
"/auth/setup",
|
|
"/api/auth",
|
|
// External service callbacks and webhooks
|
|
"/api/webhooks",
|
|
"/api/kiosk",
|
|
"/api/qbo/auth",
|
|
"/api/qbo/disconnect",
|
|
"/api/zabbix/webhook",
|
|
// Health and status checks
|
|
"/api/health",
|
|
"/api/integrations/status",
|
|
// Legal pages required by Intuit
|
|
"/legal",
|
|
// Mobile app API endpoints
|
|
"/api/mobile",
|
|
// OpenClaw external agent API (auth via x-openclaw-key header)
|
|
"/api/openclaw",
|
|
// Sync endpoints called by scheduler
|
|
"/api/sync",
|
|
"/api/datto-rmm/sync",
|
|
"/api/itglue/sync",
|
|
"/api/veeam/sync",
|
|
"/api/sentinelone/sync",
|
|
"/api/engagement/sync",
|
|
"/api/zoom/sync",
|
|
"/api/qbo/sync",
|
|
"/api/reports/ticket-digest",
|
|
"/api/notifications/morning-summary/send",
|
|
// Duo Security sync and data endpoints
|
|
"/api/duo",
|
|
];
|
|
|
|
// Routes that require admin or super-admin role
|
|
const adminRoutes = ["/admin"];
|
|
|
|
export async function middleware(request: NextRequest) {
|
|
const { pathname } = request.nextUrl;
|
|
|
|
// Allow public routes
|
|
if (publicRoutes.some((route) => pathname.startsWith(route))) {
|
|
return NextResponse.next();
|
|
}
|
|
|
|
// Allow static files
|
|
if (
|
|
pathname.startsWith("/_next") ||
|
|
pathname.startsWith("/favicon") ||
|
|
pathname.includes(".")
|
|
) {
|
|
return NextResponse.next();
|
|
}
|
|
|
|
// Check for session cookie
|
|
const sessionCookie = getSessionCookie(request);
|
|
|
|
if (!sessionCookie) {
|
|
// Redirect to sign-in if no session
|
|
const signInUrl = new URL("/auth/sign-in", request.url);
|
|
signInUrl.searchParams.set("callbackUrl", pathname);
|
|
return NextResponse.redirect(signInUrl);
|
|
}
|
|
|
|
// For admin routes, we need to verify the role
|
|
// This is a basic check - the actual role verification happens in the API routes
|
|
if (adminRoutes.some((route) => pathname.startsWith(route))) {
|
|
// The session cookie exists, but we can't decode it here without the secret
|
|
// Role-based access control is enforced at the API level
|
|
// This middleware just ensures there's a session
|
|
return NextResponse.next();
|
|
}
|
|
|
|
return NextResponse.next();
|
|
}
|
|
|
|
export const config = {
|
|
matcher: [
|
|
/*
|
|
* Match all request paths except for the ones starting with:
|
|
* - _next/static (static files)
|
|
* - _next/image (image optimization files)
|
|
* - favicon.ico (favicon file)
|
|
*/
|
|
"/((?!_next/static|_next/image|favicon.ico).*)",
|
|
],
|
|
};
|