I have set up Node red with Authelia and noticed two issues with the table-Tabulator ui-node.
Setting up access via URL-rules (resources) in Authelia:
In general, (as far as I have seen) resources for the dashboard client are downloaded via the base dashboard-url (regex): ^/dashboard/.*
(e.g. /dashboard/socket.io/?EIO=4&transport=polling&t=PI7xerP)
Tabulator however requests the following resource:
‘/admin/resources/@omrid01/node-red-dashboard-2-table-tabulator/ui-tabulator.umd.js’
which is via the base editor-url (set to "admin" in my Nodered setup):
Could it be changed to:
'/dashboard/resources/@omrid01/node-red-dashboard-2-table-tabulator/ui-tabulator.umd.js’
This makes is easier to set the rules in Authelia when some users should have access to the dashboard only.
Missing user object in msg._client
I have also installed the @aikitori/node-red-dashboard-2-authelia-auth plugin which extends message from the dashboard nodes with a user object under msg._client (i.e. msg._client.user) which contain information about the authenticated user in Authelia. I have tested this with some of the “build-in” dashboard 2 ui-nodes which works, but the object is not included in messages from the Tabulator node.
Good spot. I don't believe any of the Dashboard resources should be coming from the admin route and indeed, in some config's Dashboard users would not have permissions to access that route I don't think.
With regards to the location of ui-tabulator.umd.js, I have been using the dashboard-2 framework as-is, building on top of the ui-example prototype (from @joepavitt).
Same goes for adding a user object - I was under the impression it is handled by the framework, transparent to the node.
I'm willing to update the node, if someone could advise how, or point me to relevant documentation.
I'm not sure how Dashboard 2 works but would expect it to either automatically add a suitable user-facing route for your D2 node or instruct you how to add your own.
Node-RED creates 2 ExpressJS apps. One for the Editor and other admin endpoints and one for user-facing endpoints such as http-in/-response, D1, D2, etc. UIBUILDER adds routes to both (or creates another if you ask it to).
Each of the ExpressJS apps have separate settings.
Regarding the last issue with the missing user object, I can add that I have also tried with another "3rd-party" ui-node: @cgjgh/node-red-dashboard-2-ui-scheduler which works in that respect.
is the first issue you mentioned (web resources location) also happening with the custom dashboard-2 node?
Re the missing user object, I understand the issue is with ui-tabulator output commands. It may be related to the fact that ui-tabulator widgets send messages in a non-standard way (there's a good reason behind this).
what is the type of the ui-tabulator output msg in which the user object is missing:
Response to a message originated by a dashboard element (e.g. button)?
Response to a message originated by a server node (e.g. inject, function)?
A ui-tabulator notification (e.g. cell clicked, row changed etc.)?
First issue:
Actually yes it does:
/admin/resources/@cgjgh/node-red-dashboard-2-ui-scheduler/ui-scheduler.umd.js
Second issue:
It is only the last one in your list: notifications from the ui-tablulator element where the user object is missing.
The user object is not relevant for messages originating fro the server-side, I guess.
The buttons I tried works. But these are "built-in" ui-nodes. There is no other nodes than the tabulator node i your package?
In ui-tabulator notifications, I am currently appending a _client object with a socketId property. This may be unnecessary, if the framework is doing this automatically. Moreover, maybe because the framework sees a _client object, it lets it go and does not enrich it with a user object.
I will see what happens when I don't add a _client. Is there a way I can test your plug-in in my development environment?
OK. I see that when a widget emits notifications to the standard widget-action handler, the framework adds the _client object automatically, hence I assume it will include the user object.
The ui-tabulator widget notifications do not require the special (de-duplication) treatment used for message responses, so I will simply send them trough widget-action which will solve the issue.
As for message responses (which are sent through a custom handler), there is no need for any change, since:
Responses to server-originated messages do not (and should not) have client information
Responses to client-originated messages retain the _customer object from the input message
The @aikitori/node-red-dashboard-2-authelia-auth plugin requires the Nodered instance to be behind a proxy with Authelia to function properly, I think. I have this setup in my test environment so please let me know if I can test anything for you.
Should I register it as an issue on the Github repository?
Regarding the first issue with "admin urls". I installed a couple of other "3rd-party" ui-node and its all the same:
/admin/resources/@omrid01/node-red-dashboard-2-table-tabulator/ui-tabulator.umd.js
/admin/resources/@cgjgh/node-red-dashboard-2-ui-scheduler/ui-scheduler.umd.js
/admin/resources/@hotnipi/node-red-dashboard-2-ui-edgewise-meter/ui-edgewise-meter.umd.js
/admin/resources/@colinl/node-red-dashboard-2-ui-gauge-classic/ui-gauge-classic.umd.js
I have just released v0.6.4, now the notifications take the client object from the framework, I assume it shall include the user object and solve the issue.
