Class: AdminAuth

AdminAuth()

Decides who may use the admin interface: its pages, its socket.io connection
and the admin-only HTTP routes (session output downloads, /api).

  • With no admin password set (no Settings#defaultAdminPwd, no entries
    in Settings#admins, Settings#multipleUsers off), only the
    computer running jtree may, without logging in.
  • Otherwise everyone, on this computer or another, logs in at /admin/login with
    the password (or as a user). The login is kept in a session cookie, which the
    admin's socket.io connection carries too.

Sessions are kept in memory with a secret made at startup, so restarting jtree
logs every admin out.

Constructor

new AdminAuth()

Source:

Members

sessionMiddleware

Express (and socket.io engine) middleware that loads req.session.

Source:

Methods

findAccount() → {User|string|null}

The account matching a login, or null.

Source:
Returns:

the user (multiple users mode), the id in settings.admins, 'defaultAdmin', or null.

Type
User | string | null

isAuthorized()

Whether a request (an HTTP request, or a socket's handshake request) may act as admin.

Source:

isLocal()

Whether a request comes from the computer running jtree.

Source:

login()

POST /admin/login

Source:

passwordSet()

Whether any admin password or user account is configured.

Source:

requireAdmin()

Express middleware: lets admins through, sends everyone else to the login page.

Source:

safeNext()

Where to go after logging in: a page of this jtree, otherwise the admin.

Source:

sendLoginPage()

GET /admin/login

Source: