1
0
Fork 0
Commit Graph

12 Commits

Author SHA1 Message Date
Alan Plum e8b7e1860a Bug fix/unbreak foxx security (#9042)
* Unbreak aardvark when --foxx.api false

The easiest way to disable the aardvark foxx routes is to just skip the
import and mount altogether. The previous approach caused the service to
throw an error because the module doesn't actually export anything.
There's no need to prevent the export if we just don't import the module
to begin with.

* Add an error code for service api disabled

* Throw an actual error when accessing Foxx API routes

* Throw an error when using legacy Foxx API

There's no easy way to use a catch-all here so disable them one by one. No new routes will be added to this API and it'll go away in 4.0 so there's no risk of forgetting to add the throw-check in new routes.

* Render subnav without delay

The subnav doesn't need the perm check results but we need the subnav to exist so we can populate it in other parts of the app. This fixes the subnav not showing up when reloading certain views (e.g. install service via upload).

* Hide ONLY the Foxx store when it is disabled

We still want to allow installing and upgrading/replacing services. We just don't want to show the store.

* Hide Foxx services in frontend if Foxx API is disabled

* Build aardvark

* fixed typo in disable check, fixed tests
2019-05-21 14:45:23 +02:00
Frank Celler 148ba5f288 Revert "Fix Foxx security (#9020)"
This reverts commit a57b6b86ef.
2019-05-18 09:55:13 +02:00
Alan Plum a57b6b86ef Fix Foxx security (#9020)
* Unbreak aardvark when --foxx.api false

The easiest way to disable the aardvark foxx routes is to just skip the
import and mount altogether. The previous approach caused the service to
throw an error because the module doesn't actually export anything.
There's no need to prevent the export if we just don't import the module
to begin with.

* Add an error code for service api disabled

* Throw an actual error when accessing Foxx API routes

* Throw an error when using legacy Foxx API

There's no easy way to use a catch-all here so disable them one by one. No new routes will be added to this API and it'll go away in 4.0 so there's no risk of forgetting to add the throw-check in new routes.

* Hide Foxx services in frontend if Foxx API is disabled

* Render subnav without delay

The subnav doesn't need the perm check results but we need the subnav to exist so we can populate it in other parts of the app. This fixes the subnav not showing up when reloading certain views (e.g. install service via upload).

* Hide ONLY the Foxx store when it is disabled

We still want to allow installing and upgrading/replacing services. We just don't want to show the store.

* Build aardvark
2019-05-17 16:41:34 +02:00
Alan Plum 4b65779cc4
Add req.trustProxy, req.arangoUser, req.arangoVersion 2016-06-15 17:11:57 +02:00
Alan Plum 7c40d6d58d
Don't expose internal request user to Foxx 2016-06-15 16:32:35 +02:00
Alan Plum e6b1e0642d
Remove unused system session storage 2016-06-15 16:13:46 +02:00
Andreas Streichardt a1f9b94bce Remove session stuff 2016-06-02 17:56:26 +02:00
Alan Plum c829737568
Don't use _users in aardvark directly 2016-04-29 12:58:51 +02:00
Alan Plum c23d73f78c
Aardvark should always expect auth 2016-04-20 15:23:01 +02:00
Alan Plum b4f99a3953
Remove unused Aardvark foxxTemplates.js 2016-04-18 18:00:56 +02:00
Alan Plum fc05c019d2
Fix aardvark auth 2016-04-18 18:00:47 +02:00
Alan Plum 5d765be524
Port Aardvark to FOTF 2016-04-18 18:00:46 +02:00