feat(cms): add logout to Content Editor

Basic Auth credentials are cached by the browser until it closes, so the editor had no real logout. Add a /logout endpoint (always answers 401 with a challenge; deliberately exempt from the auth rate limiter so logging out never locks the user out) and a Kilépés button that overwrites the cached credentials with an invalid pair via fetch, then reloads into the login prompt. Closes MITHOME-56
2026-08-18 13:14:49 +02:00
parent d1cf36bc48
commit 1b45ae302c
2 changed files with 117 additions and 3 deletions
@@ -15,11 +15,11 @@ const { exec } = require('child_process');
 const crypto = require('crypto');
 const { validateContent } = require('./proto/src/content/schema');

-const PORT = 4001;
+const PORT = Number(process.env.CONTENT_EDITOR_PORT) || 4001;
 const CONTENT_DIR = path.join(__dirname, 'proto', 'src', 'content');
 const BACKUP_DIR = path.join(__dirname, '.content-backups');
 const MAX_REQUEST_BODY_BYTES = 256 * 1024;
-const AUDIT_LOG_FILE = path.join(__dirname, '.content-editor-audit.jsonl');
+const AUDIT_LOG_FILE = process.env.CONTENT_EDITOR_AUDIT_FILE || path.join(__dirname, '.content-editor-audit.jsonl');
 const RATE_LIMIT_WINDOW_MS = 15 * 60 * 1000;
 const AUTH_MAX_ATTEMPTS = 5;
 const PUBLISH_MAX_ATTEMPTS = 3;
@@ -106,6 +106,8 @@ const HTML = (activeFile, jsonData, message, csrfToken) => `<!DOCTYPE html>

    /* Bottom bar */
    .bottom-bar { position: fixed; bottom: 0; left: 0; right: 0; background: #0f1117; border-top: 1px solid #2d3748; padding: 14px 32px; display: flex; gap: 14px; align-items: center; z-index: 50; }
+    .btn-logout { margin-left: auto; background: #1f2937; color: #e2e8f0; border: 1px solid #374151; border-radius: 8px; padding: 9px 16px; font-size: 14px; cursor: pointer; }
+    .btn-logout:hover { background: #374151; }
    .btn-save { background: linear-gradient(135deg,#3b82f6,#6366f1); color: #fff; border: none; padding: 11px 26px; border-radius: 8px; font-size: 14px; font-weight: 600; cursor: pointer; transition: opacity .2s, transform .1s; }
    .btn-save:hover { opacity: .9; transform: translateY(-1px); }
    .btn-save:active { transform: translateY(0); }
@@ -149,6 +151,7 @@ ${message ? `<div class="toast ${message.type === 'ok' ? 'ok' : 'err'}">${messag
  <button class="btn-publish" onclick="publish()" id="publishBtn">🚀 Publikálás & ${CMS_DEPLOY_ENV === 'staging' ? 'Staging deploy' : 'Élesítés'}</button>
  <span class="save-status" id="saveStatus"></span>
  <a href="${CMS_DEPLOY_ENV === 'staging' ? 'https://stage.mozdit.hu' : 'http://localhost:3000'}" target="_blank" class="preview-link">🔗 Előnézet →</a>
+  <button class="btn-logout" onclick="logout()">🚪 Kilépés</button>
 </div>

 <script id="page-data" type="application/json">${jsonData.replace(/<\//g, '<\\/')}</script>
@@ -436,6 +439,16 @@ async function publish() {
  setTimeout(() => status.style.display = 'none', 5000);
 }

+async function logout() {
+  // WHY: the browser caches Basic Auth credentials until it closes. One request with
+  // deliberately invalid credentials overwrites the cache, so the reload below
+  // prompts for login again. fetch() never triggers the native auth dialog.
+  try {
+    await fetch('/logout', { headers: { 'Authorization': 'Basic ' + btoa('logout:logout') } });
+  } catch (e) { /* network error — reload anyway */ }
+  location.reload();
+}
+
 function esc(v) {
  return String(v).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
 }
@@ -523,6 +536,19 @@ const server = http.createServer(async (req, res) => {
    res.end('Content Editor is disabled: CMS_USER and CMS_PASS must be configured.');
    return;
  }
+
+  const u = new URL(req.url, `http://localhost:${PORT}`);
+
+  // WHY: Basic Auth credentials are cached by the browser until it closes, so there is
+  // no native logout. The client calls /logout with deliberately invalid credentials,
+  // which overwrites the cached pair; the next navigation prompts for login again.
+  // Deliberately exempt from the auth rate limiter so logging out never locks the user out.
+  if (u.pathname === '/logout') {
+    res.writeHead(401, { 'WWW-Authenticate': 'Basic realm="mozdIT CMS"' });
+    res.end('Logged out');
+    return;
+  }
+
  if (!hasValidCredentials(req)) {
    const limited = exceedsRateLimit(`auth:${clientAddress}`, AUTH_MAX_ATTEMPTS);
    writeAudit('authentication_failed', { clientAddress, limited });
@@ -536,7 +562,6 @@ const server = http.createServer(async (req, res) => {
    return;
  }

-  const u = new URL(req.url, `http://localhost:${PORT}`);
  const fileKey = u.searchParams.get('file') || 'home';
  const activeFile = FILES[fileKey] ? fileKey : 'home';