infra/stacks/node-red/config/settings.js

// Node-RED config — Keycloak OIDC editor auth.
// Only the editor (/red, /flow) is gated; runtime HTTP-in / dashboard routes
// stay open by default. Lock those down separately with httpNodeAuth.

// Admins listed here get permissions "*". Everyone else (any authenticated
// Keycloak user) gets ["read"] — they can view flows but cannot deploy.
const NODERED_ADMINS = (process.env.NODERED_ADMIN_USERS || "")
    .split(",")
    .map(s => s.trim().toLowerCase())
    .filter(Boolean);

function permissionsFor(username) {
    return NODERED_ADMINS.includes((username || "").toLowerCase()) ? "*" : ["read"];
}

// In-memory state store for the OIDC handshake. Node-RED's adminAuth gives us
// req.session, but for safety (and because we don't actually need anything
// beyond CSRF on the state param), we keep state in a process-local Map keyed
// by a random handle (sent as the `state` query param).
const _crypto = require("crypto");
const _stateStore = new Map();
const _STATE_TTL_MS = 10 * 60 * 1000;
setInterval(function() {
    const now = Date.now();
    for (const [k, v] of _stateStore) {
        if (v.expires < now) _stateStore.delete(k);
    }
}, 60 * 1000).unref();

module.exports = {
    uiPort: process.env.PORT || 1880,

    adminAuth: {
        type: "strategy",
        strategy: {
            name: "openidconnect",
            label: "Sign in with Keycloak",
            icon: "fa-sign-in",
            strategy: require("passport-openidconnect").Strategy,
            options: {
                issuer:           "https://auth.wbd-rd.nl/realms/wbd",
                authorizationURL: "https://auth.wbd-rd.nl/realms/wbd/protocol/openid-connect/auth",
                tokenURL:         "https://auth.wbd-rd.nl/realms/wbd/protocol/openid-connect/token",
                userInfoURL:      "https://auth.wbd-rd.nl/realms/wbd/protocol/openid-connect/userinfo",
                clientID:     process.env.NODERED_OAUTH_CLIENT_ID || "node-red",
                clientSecret: process.env.NODERED_OAUTH_CLIENT_SECRET,
                callbackURL:  "https://flow.wbd-rd.nl/auth/strategy/callback/",
                scope:        ["openid", "email", "profile"],
                proxy: true,
                store: {
                    store: function(req, ctx, appState, meta, cb) {
                        const handle = _crypto.randomBytes(18).toString("hex");
                        _stateStore.set(handle, {
                            ctx: ctx || {},
                            appState: appState,
                            expires: Date.now() + _STATE_TTL_MS,
                        });
                        cb(null, handle);
                    },
                    verify: function(req, handle, cb) {
                        const entry = _stateStore.get(handle);
                        if (!entry) return cb(null, false, { message: "Unknown auth state" });
                        _stateStore.delete(handle);
                        if (entry.expires < Date.now()) {
                            return cb(null, false, { message: "Expired auth state" });
                        }
                        cb(null, entry.ctx, entry.appState);
                    },
                },
                // Standard 3-arg verify; pass the username forward so users(username) can build the user.
                verify: function(issuer, profile, done) {
                    const json = (profile && profile._json) || {};
                    const username = (
                        (profile && profile.username)
                        || json.preferred_username
                        || (profile && profile.emails && profile.emails[0] && profile.emails[0].value)
                        || json.email
                        || (profile && profile.id)
                        || "unknown"
                    ).toString().toLowerCase();
                    done(null, { username: username });
                },
            },
        },
        // Resolve a username (as produced by verify above) into a full Node-RED user.
        // Anyone the realm vouches for is allowed in; admins from NODERED_ADMIN_USERS get "*",
        // everyone else gets read-only.
        users: function(username) {
            return Promise.resolve({
                username: (username || "").toLowerCase(),
                permissions: permissionsFor(username),
            });
        },
    },

    editorTheme: {
        projects: { enabled: false },
        page: { title: "WBD Node-RED" },
    },

    functionGlobalContext: {},

    logging: {
        console: {
            level: "info",
            metrics: false,
            audit: false,
        },
    },
};