CLI and partial Webvault compatibility

[vvondra]

PR for #1

@Pschittt, check out my latest commit. There were some runtime errors with bad imports and I also made all the routes respond with the same OPTIONS CORS headers.

Now on login through webvault I get a successful login and when it hit the /keys endpoint, it doesn't pass any Authorization information. Checking why

[vvondra]

@Pschittt I found the problem with the /keys endpoint.

The Angular JWT plugin web uses must whitelist domains where it will send the JWT. Unfortunately it's hardcoded in this file.
https://github.com/bitwarden/web/blob/master/src/app/config.js#L19

When I edited the file locally and added the domain of my API Gateway, I received the Bearer token.

Do you want to continue working on this ticket and finish it up? I see some more endpoints are needed such as /profile etc.

One thing to watch out, check coding style with ./node_modules/.bin/eslint . in the root of the project. It will catch a lot of errors for you and I can't merge it until ESLint passes.

[Pschittt]

@vvondra I've pulled your latest commit, to continue with your version.

About the JWT not sent, it's curious, because I have a web vault running perfectly with the API-Ruby backend.
And indeed, there is a config file (setting.Production.json) where we set a whitelist domain.
I did "gulp build" the web vault, and then checked the config.js file, and it's still the bitwarden domain set.

I'll keep looking.

I confirm, there is a log of endpoint to add. But the "hardwork" has been done here :
[https://github.com/jcs/rubywarden/pull/14]

About ESLint, I don't understand. I don't seen any file ./node_modules/.bin/eslint
And how does it work ?

[vvondra]

@Pschittt run npm install locally, then eslint should be in that path of the project installed, it just checks codestyle, syntax errors, invalid definitions and references etc.

I think the Bitwarden author merged some recent changes, maybe you have some older version of web vault for the Ruby port?

Here is my diff of the web vault locally where it works for me:

diff --git a/package.json b/package.json
index 3745ba2..43bb1df 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "bitwarden",
   "version": "1.22.0",
-  "env": "Production",
+  "env": "Development",
   "devDependencies": {
     "connect": "3.6.5",
     "lodash": "4.17.4",
diff --git a/settings.json b/settings.json
index 9029e0c..48501b4 100644
--- a/settings.json
+++ b/settings.json
@@ -1,7 +1,7 @@
 {
   "appSettings": {
-    "apiUri": "http://localhost:4000",
-    "identityUri": "http://localhost:33656",
+    "apiUri": "https://abcded.execute-api.us-east-1.amazonaws.com/test/api",
+    "identityUri": "https://abcded.execute-api.us-east-1.amazonaws.com/test/identity",
     "iconsUri": "https://icons.bitwarden.com",
     "stripeKey": "pk_test_KPoCfZXu7mznb9uSCPZ2JpTD",
     "braintreeKey": "sandbox_r72q8jq6_9pnxkwm75f87sdc2"
diff --git a/src/app/config.js b/src/app/config.js
index 5e50d69..e82df21 100644
--- a/src/app/config.js
+++ b/src/app/config.js
@@ -16,7 +16,7 @@ angular
 
         // @if false
         jwtOptionsProvider.config({
-            whiteListedDomains: ['localhost', 'api.bitwarden.com', 'vault.bitwarden.com']
+            whiteListedDomains: ['localhost', 'api.bitwarden.com', 'vault.bitwarden.com', 'abcded.execute-api.us-east-1.amazonaws.com']
         });
         // @endif

[Pschittt]

I have the pretty same config as you. Only on the config.js file (for the web vault), I've used a variable for the WhitelistDomain.

I have commented the line whiteListedDomains ... and added :
whiteListedDomains : appSettings.whitelistDomains

And I've defined the "whitelistDomains" in the settings.js file with the api url.

With that, I can get the bearer send by the web vault.

[Pschittt]

@vvondra You're right. It has been hardcoded a few days ago.
https://github.com/bitwarden/web/commit/1d0b45e17daff5e2fb2b99575205c866688e192d#diff-bbaf1860cc4806373b585f73c46fc33e

[vvondra]

I think at this point Web is still not working (and it's not so easy to set up a custom deployment with custom URL anyway), but the changes here make it work with the CLI.