Show admin access status information in Service settings page

postalsys · Sep 9, 2024 · 2e99e66 · 2e99e66
1 parent 7b64009
commit 2e99e66
Show file tree

Hide file tree

Showing 3 changed files with 48 additions and 2 deletions.
diff --git a/lib/routes-ui.js b/lib/routes-ui.js
@@ -21,7 +21,8 @@ const {
     getByteSize,
     getDuration,
     parseSignedFormData,
-    updatePublicInterfaces
+    updatePublicInterfaces,
+    hasEnvValue
 } = require('./tools');
 const packageData = require('../package.json');
 const he = require('he');
@@ -93,6 +94,13 @@ config.api = config.api || {
 const MAX_BODY_SIZE = getByteSize(readEnvValue('EENGINE_MAX_BODY_SIZE') || config.api.maxBodySize) || DEFAULT_MAX_BODY_SIZE;
 const MAX_PAYLOAD_TIMEOUT = getDuration(readEnvValue('EENGINE_MAX_PAYLOAD_TIMEOUT') || config.api.maxPayloadTimeout) || DEFAULT_MAX_PAYLOAD_TIMEOUT;
 
+const ADMIN_ACCESS_ADDRESSES = hasEnvValue('EENGINE_ADMIN_ACCESS_ADDRESSES')
+    ? readEnvValue('EENGINE_ADMIN_ACCESS_ADDRESSES')
+          .split(',')
+          .map(v => v.trim())
+          .filter(v => v)
+    : null;
+
 const { fetch: fetchCmd, Agent } = require('undici');
 const fetchAgent = new Agent({ connect: { timeout: FETCH_TIMEOUT } });
 
@@ -1283,6 +1291,8 @@ function applyRoutes(server, call) {
                         selected: entry.tzCode === values.timezone
                     })),
 
+                    adminAccessLimit: ADMIN_ACCESS_ADDRESSES && ADMIN_ACCESS_ADDRESSES.length,
+
                     values
                 },
                 {
@@ -1343,7 +1353,9 @@ function applyRoutes(server, call) {
                             name: entry.label,
                             timezone: entry.tzCode,
                             selected: entry.tzCode === request.payload.timezone
-                        }))
+                        })),
+
+                        adminAccessLimit: ADMIN_ACCESS_ADDRESSES && ADMIN_ACCESS_ADDRESSES.length
                     },
                     {
                         layout: 'app'
@@ -1389,6 +1401,8 @@ function applyRoutes(server, call) {
                                     selected: entry.tzCode === request.payload.timezone
                                 })),
 
+                                adminAccessLimit: ADMIN_ACCESS_ADDRESSES && ADMIN_ACCESS_ADDRESSES.length,
+
                                 errors
                             },
                             {

diff --git a/views/config/service.hbs b/views/config/service.hbs
@@ -159,6 +159,26 @@
                         referrerpolicy="no-referrer">documentation</a>.</small>
             </div>
 
+
+            <div class="form-group form-check">
+
+                <div class="text-muted float-right code-link">[EENGINE_ADMIN_ACCESS_ADDRESSES]</div>
+
+                <input type="checkbox" class="form-check-input" id="adminAccessLimit" {{#if
+                    adminAccessLimit}}checked{{/if}} disabled />
+                <label class="form-check-label" for="adminAccessLimit">Limit Access to Admin Interface
+
+                    <span class="badge badge-{{#if adminAccessLimit}}success{{else}}danger{{/if}}">{{#if
+                        adminAccessLimit}}enabled{{else}}disabled{{/if}}</span>
+
+                </label>
+                <small class="form-text text-muted">Access to the Admin interface cannot be modified at runtime. To
+                    restrict access to EmailEngine’s Admin interface while keeping other parts of the app open, set the
+                    <code>EENGINE_ADMIN_ACCESS_ADDRESSES</code> environment variable when starting EmailEngine. Provide
+                    a comma-separated list of IP addresses that are permitted to access the Admin interface.</small>
+            </div>
+
+
             <div class="form-group form-check">
                 <div class="text-muted float-right code-link">[<em>Web UI only</em>]</div>
                 <input type="checkbox" class="form-check-input {{#if errors.enableOAuthTokensApi}}is-invalid{{/if}}"

diff --git a/workers/api.js b/workers/api.js
@@ -701,6 +701,18 @@ const init = async () => {
 
         if (ADMIN_ACCESS_ADDRESSES && ADMIN_ACCESS_ADDRESSES.length) {
             if (/^\/admin\b/i.test(request.path) && !matchIp(request.app.ip, ADMIN_ACCESS_ADDRESSES)) {
+                logger.info({
+                    msg: 'Blocked access from unlisted IP address',
+                    remoteAddress: request.app.ip,
+                    allowedAddresses: ADMIN_ACCESS_ADDRESSES,
+                    component: 'api',
+                    req: {
+                        method: request.method,
+                        url: request.path,
+                        query: request.query
+                    }
+                });
+
                 return h
                     .view(
                         'error',