Whenever I'm working on custom nodes, the following situation has me diving back into the docs every single time, and the docs kindly explain that this is still a TODO waiting to be added. I'm hoping this topic can become detailed enough that the documentation for it can be written and published.
When needing to add an endpoint to the node I'm working on, I always wonder whether I need to use RED.httpNode or RED.httpAdmin for it. The API reference says that httpNode is "the Express application for HTTP Nodes", and that httpAdmin is "the Express application for the Editor Admin API". From previous topics on here I've learned that httpAdmin has the option to use the RED.auth, the editor authentication api, to request permissions, for which the permissions for adminAuth from the settings file are used/checked.
The comments in the default settings file give more suggestions:
// By default, the Node-RED UI is available at http://localhost:1880/
// The following property can be used to specify a different root path.
// If set to false, this is disabled.
//httpAdminRoot: '/admin',
// Some nodes, such as HTTP In, can be used to listen for incoming http requests.
// By default, these are served relative to '/'. The following property
// can be used to specifiy a different root path. If set to false, this is
// disabled.
//httpNodeRoot: '/red-nodes',
// Securing Node-RED
// -----------------
// To password protect the Node-RED editor and admin API, the following
// property can be used. See http://nodered.org/docs/security.html for details.
//adminAuth: {
// type: "credentials",
// users: [{
// username: "admin",
// password: "$2a$08$zZWtXTja0fB1pzD4sHCMyOCMYz2Z6dNbM6tl8sJogENOMcxWV9DN.",
// permissions: "*"
// }]
//},
// To password protect the node-defined HTTP endpoints (httpNodeRoot), or
// the static content (httpStatic), the following properties can be used.
// The pass field is a bcrypt hash of the password.
// See http://nodered.org/docs/security.html#generating-the-password-hash
//httpNodeAuth: {user:"user",pass:"$2a$08$zZWtXTja0fB1pzD4sHCMyOCMYz2Z6dNbM6tl8sJogENOMcxWV9DN."},
//httpStaticAuth: {user:"user",pass:"$2a$08$zZWtXTja0fB1pzD4sHCMyOCMYz2Z6dNbM6tl8sJogENOMcxWV9DN."},
To me, it suggests that RED.httpAdmin is primarily aimed at providing interaction between the runtime and the editor, and that RED.httpNode adds additional endpoints to the runtime, like the use of HTTP-In/HTTP-Response nodes would do. As the settings for adminAuth are used on the login form, it makes sense for RED.auth.needsPermission to be meant for the active user logged in to the editor. From experience, enabling the httpNodeAuth results in a Basic Authentication login, and as there are no permissions present there it makes sense for this to be for all runtime exposing endpoints.
Am I correct in the assumptions above?
