Merge pull request #352 from appdevforall/feat/ADFA-5044-server-verify-calibre

ADFA-5044: dash-node 1.1.5 — verify Calibre-Web on save + expose default password for prefill

Author: luisguzman-adfa

static/dashboard/CHANGELOG.md

@@ -4,6 +4,7 @@ One line per version, newest first. Every REST-facing change bumps the version i
 (the app surfaces it via `/system/dashboard/update-check` and the "Update available" pill), so this
 file is the human record of what each bump enables. Keep entries short: `version - change (TICKET)`.
 
+- **1.1.5** - Credentials: `POST /credentials/calibre` now validates against live Calibre-Web (401 on reject, save-unverified when the service is down); `GET /credentials/:service` returns the default password only while still at the factory default, for full form prefill. (ADFA-5044)
 - **1.1.4** - Calibre-Web auto-login: send Flask-Login `remember_me` so the session includes a persistent `remember_token`, which sticks in the WebView despite anonymous/guest browsing. (ADFA-5043)
 - **1.1.3** - `/auth/:service/session`: server-side login returning the session cookie, for WebView auto-login as box admin (Calibre-Web / Kolibri). (ADFA-5043)
 - **1.1.2** - ZIM download URL built from the project subdir (`/zim/<project>/<file>`), so non-Wikipedia ZIMs download instead of 404ing. Pairs with the app sending `<project>/<file>`. (ADFA-5042)

static/dashboard/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "dashboard-console",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "description": "",
   "main": "index.js",
   "scripts": {

static/dashboard/package.json

@@ -9,7 +9,7 @@ import { spawn } from 'child_process';
 import fs from 'fs';
 import path from 'path';
 import { jobs, Job, JobType } from './sockets/jobs';
-import { searchCatalog, listLibrary, removeBook, listLanguages, getCalibreSession } from './sockets/books.query';
+import { searchCatalog, listLibrary, removeBook, listLanguages, getCalibreSession, verifyCalibreCredentials } from './sockets/books.query';
 import { parseBox, parseEstimate } from './sockets/maps.socket';
 import {
     preflight, listInstalledChannels, browseRemoteChannels, resolveIdentifier,
@@ -521,15 +521,45 @@ apiRouter.post('/credentials/:service', async (req: Request, res: Response): Pro
         return;
     }
 
-    // Por ahora solo Kolibri se valida en vivo. Para otros servicios se guarda tal
-    // cual (calibre sigue con sus constantes hasta que se migre en su propio PR).
-    if (service !== 'kolibri') {
+    // Persist + respond in one place so the verified/unverified branches can't drift apart.
+    const saveAndRespond = (verified: boolean): void => {
         try {
             setCredential(service, { username, password });
-            res.json({ ok: true, verified: false, service });
+            res.json({ ok: true, verified, service, username });
         } catch (e: any) {
             res.status(500).json({ error: e?.message || 'save failed' });
         }
+    };
+
+    // ADFA-5044: Calibre-Web is now validated live too. If it authenticates we save verified; if it
+    // rejects the credentials we return 401 (nothing saved); if it's unreachable (not installed yet)
+    // we save unverified so the sign-in can be pre-set and applies once the service is up.
+    // Note: unlike Kolibri (which also checks canManageContent -> 403), this only checks that the
+    // credentials authenticate, not that the account can manage content — Calibre-Web role-checking
+    // is a separate, heavier step and login success is a reasonable bar for the admin sign-in.
+    if (service === 'calibre') {
+        try {
+            await verifyCalibreCredentials(username, password);
+        } catch (e: any) {
+            if (/invalid.*cred/i.test(e?.message || '')) {
+                res.status(401).json({ error: 'Calibre-Web rejected these credentials', saved: false });
+                return;
+            }
+            // Service unreachable (not installed/running) or its login form couldn't be parsed. We
+            // still save so the sign-in can be pre-set, but log it: a parse failure while the service
+            // is up would otherwise be an invisible "saved but never verified".
+            console.warn('[credentials] calibre verify skipped: '
+                + (e?.message || e) + ' — saving unverified');
+            saveAndRespond(false);
+            return;
+        }
+        saveAndRespond(true);
+        return;
+    }
+
+    // Any other (future) service that has no live check yet is stored as-is.
+    if (service !== 'kolibri') {
+        saveAndRespond(false);
         return;
     }
 

static/dashboard/routes.ts

@@ -107,7 +107,11 @@ export function listLibrary(): any[] {
     }
 }
 
-export async function getCalibreSession(): Promise<{ cookie: string; csrfToken: string }> {
+/** Log into Calibre-Web with the given credentials and return the authenticated session.
+ *  A successful login answers with a 302/303 redirect; anything else means the credentials were
+ *  rejected (thrown as 'Invalid Calibre-Web credentials'). A connection error (service down) throws
+ *  the underlying fetch error, so callers can tell "wrong password" from "not running". */
+async function loginCalibre(username: string, password: string): Promise<{ cookie: string; csrfToken: string }> {
     const loginPageRes = await fetch(`${CALIBRE_WEB_LOCAL_URL}/login`);
     const initialCookies = loginPageRes.headers.getSetCookie().map((c) => c.split(';')[0]).join('; ');
     const loginHtml = await loginPageRes.text();
@@ -117,9 +121,8 @@ export async function getCalibreSession(): Promise<{ cookie: string; csrfToken:
 
     const loginData = new URLSearchParams();
     loginData.append('csrf_token', csrfToken);
-    const cred = getCredential('calibre');
-    loginData.append('username', cred.username);
-    loginData.append('password', cred.password);
+    loginData.append('username', username);
+    loginData.append('password', password);
     // ADFA-5043: request Flask-Login's persistent "remember me" so the response also sets a
     // `remember_token` cookie. Calibre-Web allows anonymous (guest) browsing, so the session cookie
     // alone doesn't stick in the WebView; the remember_token re-authenticates as admin reliably.
@@ -145,6 +148,18 @@ export async function getCalibreSession(): Promise<{ cookie: string; csrfToken:
     return { cookie: authCookieString, csrfToken: finalCsrfMatch ? finalCsrfMatch[1] : csrfToken };
 }
 
+export async function getCalibreSession(): Promise<{ cookie: string; csrfToken: string }> {
+    const cred = getCredential('calibre');
+    return loginCalibre(cred.username, cred.password);
+}
+
+/** ADFA-5044: check credentials against the live Calibre-Web before persisting them. Resolves on a
+ *  successful login; throws 'Invalid Calibre-Web credentials' when rejected, or the fetch error when
+ *  the service is unreachable (so the route can save-unverified instead of reporting a bad password). */
+export async function verifyCalibreCredentials(username: string, password: string): Promise<void> {
+    await loginCalibre(username, password);
+}
+
 /** Remove a book from Calibre-Web by its library id. */
 export async function removeBook(id: number): Promise<void> {
     const s = await getCalibreSession();

static/dashboard/sockets/books.query.ts

@@ -137,24 +137,31 @@ export function clearCredential(service: ServiceName): void {
     writeStore(store);
 }
 
-/** Vista segura para la UI: nunca devuelve la contraseña, solo si hay una y de
- *  dónde viene. Es lo que el webview necesita para pintar el formulario. */
+/** Vista para la UI. La contraseña personalizada NUNCA se devuelve. Excepción (ADFA-5044): cuando el
+ *  servicio sigue con el default de fábrica —que es público y documentado (Admin/changeme en IIAB)— se
+ *  incluye para que el formulario pueda prellenar el sign-in completo. En cuanto hay un override, se
+ *  omite de nuevo. Es seguro porque no expone ningún secreto real y el API es localhost-only. */
 export function describeCredential(service: ServiceName): {
     service: ServiceName;
     username: string;
     origin: CredentialOrigin;
     isDefault: boolean;
+    password?: string;
 } {
     const c = getCredential(service);
-    return {
-        service,
-        username: c.username,
-        origin: c.origin,
-        // Señal para que la UI pueda avisar "sigues con la contraseña de fábrica".
-        isDefault: c.origin === 'default'
-            || (c.username === DEFAULTS[service].username
-                && c.password === DEFAULTS[service].password),
-    };
+    // Señal para que la UI pueda avisar "sigues con la contraseña de fábrica".
+    const isDefault = c.origin === 'default'
+        || (c.username === DEFAULTS[service].username
+            && c.password === DEFAULTS[service].password);
+    const out: {
+        service: ServiceName;
+        username: string;
+        origin: CredentialOrigin;
+        isDefault: boolean;
+        password?: string;
+    } = { service, username: c.username, origin: c.origin, isDefault };
+    if (isDefault) out.password = DEFAULTS[service].password;
+    return out;
 }
 
 export const CREDENTIALS_STORE_PATH = STORE_PATH;