Skylar Grant
b6ef6a195c
Each user now signs in with their own Zoho account through the web OAuth flow (Server-based Application client), and every SDP query runs with that user's token. Nobody who reaches the page can see data without signing in. - auth.js: authorization URL, code exchange, token renewal, revoke and user info, replacing the device-code flow. - session.js: tokens kept in an AES-256-GCM encrypted, HttpOnly, SameSite=Lax cookie keyed by SESSION_SECRET. The access token renews when due, concurrent calls share one renewal, and sessions end after SESSION_DAYS. - routes.js: /auth/login, /auth/callback (state checked), /auth/logout (revokes at Zoho); /api/session, /api/closed, /api/workload and /api/weather all need a sign-in. - The server is stateless. boardService.js, tokenStore.js, ADMIN_KEY and data/token.json are gone. The page runs the checks itself and keeps the closed feed, backfilling 12 hours on first load. - tickets.js: the closed feed query pages, and SDP 401s are rethrown so the user is signed out. - server.js: PUBLIC_URL, trust proxy, security headers, /healthz. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
28 lines
697 B
JSON
28 lines
697 B
JSON
{
|
|
"name": "sdp-request-watcher",
|
|
"version": "1.0.0",
|
|
"description": "A hosted help desk dashboard for ManageEngine ServiceDesk Plus Cloud, with per-user Zoho sign-in.",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://git.vfsh.dev/sgrant/sdp-request-watcher.git"
|
|
},
|
|
"license": "MIT",
|
|
"author": "Skylar Grant",
|
|
"contributors": [
|
|
"Isaac Godin",
|
|
"Claude (Anthropic) <noreply@anthropic.com>"
|
|
],
|
|
"type": "commonjs",
|
|
"main": "src/server.js",
|
|
"scripts": {
|
|
"app": "node src/server.js",
|
|
"test": "echo \"Error: no test specified\" && exit 1"
|
|
},
|
|
"dependencies": {
|
|
"axios": "1.x",
|
|
"dotenv": "18.x",
|
|
"express": "5.x"
|
|
},
|
|
"devDependencies": {}
|
|
}
|