chore: make admin routes not need m2m tokens

Author: Bccorb

.env.example

@@ -32,8 +32,8 @@ RATE_LIMIT=100
 DELAY_AFTER=50
 
 # OPTIONAL SERVICE TOKENS
-# Used only if enabling admin or automation endpoints
-API_SERVICE_TOKEN=GRAB_FROM_SEAMLESS_AUTH_PORTAL
+# Used only if enabling admin or m2m communications
+API_SERVICE_TOKEN=32-byte-hex-string
 
 # JWKS
 JWKS_ACTIVE_KID=dev-main

docker-compose.yml

@@ -5,7 +5,7 @@ services:
       dockerfile: Dockerfile.dev
     container_name: seamless-auth
     ports:
-      - '5312:5312'
+      - "5312:5312"
     volumes:
       - .:/app
       - /app/node_modules
@@ -17,7 +17,7 @@ services:
       postgres:
         condition: service_healthy
     healthcheck:
-      test: ['CMD', 'node', './healthCheck.js']
+      test: ["CMD", "node", "./healthCheck.js"]
       interval: 30s
       timeout: 5s
       retries: 3
@@ -27,18 +27,29 @@ services:
     restart: always
     container_name: db
     ports:
-      - '5432:5432'
+      - "5432:5432"
     environment:
       POSTGRES_USER: myuser
       POSTGRES_PASSWORD: mypassword
       POSTGRES_DB: postgres
     healthcheck:
-      test: ['CMD-SHELL', 'pg_isready -U myuser -d postgres']
+      test: ["CMD-SHELL", "pg_isready -U myuser -d postgres"]
       interval: 5s
       timeout: 5s
       retries: 5
     volumes:
       - pgdata:/var/lib/postgresql/data
 
+  admin:
+    image: seamless-admin:local
+    container_name: seamless-admin
+    ports:
+      - "5174:80"
+    depends_on:
+      - api
+    environment:
+      API_URL: http://localhost:5312
+    restart: unless-stopped
+
 volumes:
-  pgdata:
+  pgdata:

src/controllers/internalSecurity.ts

@@ -54,7 +54,6 @@ export const getSecurityAnomalies = async (_req: Request, res: Response) => {
       attributes: ['user_id', 'type', 'ip_address', 'user_agent', 'metadata', 'created_at'],
     });
 
-    console.log('events', events);
     return res.json({
       suspiciousEvents: events,
       total: events.length,

src/middleware/requireAdmin.ts

@@ -14,11 +14,6 @@ const logger = getLogger('requireAdmin');
 export function requireAdmin() {
   return (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
     try {
-      if (!req.clientId) {
-        logger.error('Admin route hit without service identity');
-        return res.status(401).json({ error: 'Unauthorized' });
-      }
-
       if (!req.user) {
         logger.error('Admin route hit without authenticated user');
         return res.status(401).json({ error: 'Unauthorized' });

src/routes/admin.routes.ts

@@ -41,7 +41,7 @@ adminRouter.get(
   {
     summary: 'List users (internal)',
     tags: ['Admin'],
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
 
     schemas: {
       response: {
@@ -56,7 +56,7 @@ adminRouter.get(
 adminRouter.get(
   '/auth-events',
   {
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
     tags: ['Admin'],
     schemas: {
       query: AuthEventQuerySchema,
@@ -73,7 +73,7 @@ adminRouter.get(
   {
     summary: 'Get credential count',
     tags: ['Admin'],
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
 
     schemas: {
       response: {
@@ -89,7 +89,7 @@ adminRouter.post(
   '/users',
   {
     tags: ['Admin'],
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
     schemas: {
       body: CreateUserSchema,
     },
@@ -102,7 +102,7 @@ adminRouter.delete(
   {
     summary: 'Delete user',
     tags: ['Admin'],
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
 
     schemas: {
       response: {
@@ -119,7 +119,7 @@ adminRouter.patch(
   {
     summary: 'Update user',
     tags: ['Admin'],
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
 
     schemas: {
       body: UpdateUserSchema,
@@ -138,7 +138,7 @@ adminRouter.get(
   '/users/:userId',
   {
     tags: ['Admin'],
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
   },
   getUserDetail,
 );
@@ -147,7 +147,7 @@ adminRouter.get(
   '/users/:userId/anomalies',
   {
     tags: ['Admin'],
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
   },
   getUserAnomalies,
 );
@@ -156,7 +156,7 @@ adminRouter.get(
   '/sessions',
   {
     tags: ['Admin'],
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
     schema: {
       query: PaginationQuerySchema,
     },
@@ -167,7 +167,7 @@ adminRouter.get(
 adminRouter.get(
   '/sessions/:userId',
   {
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
     tags: ['Admin'],
     schemas: {
       params: UserIdParamSchema,
@@ -183,7 +183,7 @@ adminRouter.get(
 adminRouter.delete(
   '/sessions/:userId/revoke-all',
   {
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
     tags: ['Admin'],
     schemas: {
       params: UserIdParamSchema,

src/routes/internal.routes.ts

@@ -23,7 +23,7 @@ const internalRouter = createRouter('/internal');
 internalRouter.get(
   '/auth-events/summary',
   {
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
     tags: ['Internal'],
     schemas: {
       query: MetricsQuerySchema,
@@ -35,7 +35,7 @@ internalRouter.get(
 internalRouter.get(
   '/auth-events/timeseries',
   {
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
     tags: ['Internal'],
     schemas: {
       query: MetricsQuerySchema,
@@ -47,7 +47,7 @@ internalRouter.get(
 internalRouter.get(
   '/auth-events/login-stats',
   {
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
     tags: ['Internal'],
   },
   getLoginStats,
@@ -56,7 +56,7 @@ internalRouter.get(
 internalRouter.get(
   '/security/anomalies',
   {
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
     summary: 'Detect suspicious activity',
     tags: ['Internal'],
   },
@@ -66,7 +66,7 @@ internalRouter.get(
 internalRouter.get(
   '/metrics/dashboard',
   {
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
     summary: 'Dashboard metrics',
     tags: ['Internal'],
   },
@@ -76,7 +76,7 @@ internalRouter.get(
 internalRouter.get(
   '/auth-events/grouped',
   {
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
     summary: 'Auth Event metrics grouped',
     tags: ['Internal'],
   },

src/routes/systemConfig.routes.ts

@@ -28,7 +28,7 @@ systemConfigRouter.get(
     summary: 'Get available roles',
     tags: ['SystemConfig'],
 
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
   },
   getAvailableRoles,
 );
@@ -39,7 +39,7 @@ systemConfigRouter.get(
     summary: 'Retrieve system configuration',
     tags: ['SystemConfig'],
 
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
 
     schemas: {
       response: {
@@ -58,7 +58,7 @@ systemConfigRouter.patch(
     summary: 'Update system configuration',
     tags: ['SystemConfig'],
 
-    middleware: [verifyServiceToken, attachAuthMiddleware(), requireAdmin()],
+    middleware: [attachAuthMiddleware(), requireAdmin()],
 
     schemas: {
       response: {