allow to configure ASP limit dynamically

api.js

@@ -22,6 +22,7 @@ const util = require('util');
 const ObjectId = require('mongodb').ObjectId;
 const tls = require('tls');
 const Lock = require('ioredfour');
+const Path = require('path');
 
 const acmeRoutes = require('./lib/api/acme');
 const usersRoutes = require('./lib/api/users');
@@ -192,8 +193,6 @@ server.use((req, res, next) => {
     next();
 });
 
-server.use(restify.plugins.gzipResponse());
-
 server.use(
     restify.plugins.queryParser({
         allowDots: true,
@@ -210,7 +209,15 @@ server.use(
 );
 
 // public files
-server.get({ name: 'public_get', path: '/public/*' }, restify.plugins.serveStaticFiles('./public'));
+server.get(
+    { name: 'public_get', path: '/public/*' },
+    restify.plugins.serveStatic({
+        directory: Path.join(__dirname, 'public'),
+        default: 'index.html'
+    })
+);
+
+server.use(restify.plugins.gzipResponse());
 
 server.use(
     tools.asyncifyJson(async (req, res, next) => {

lib/consts.js

@@ -117,6 +117,7 @@ module.exports = {
     // challenge timeout in seconds
     WEBAUTHN_CHALLENGE_TTL: 1 * 60 * 60,
 
+    // Default maximum application password limit
     // Outlook limits to 40
     // https://support.microsoft.com/en-gb/account-billing/manage-app-passwords-for-two-step-verification-d6dc8c6d-4bf7-4851-ad95-6d07799387e9
     MAX_ASP_COUNT: 50

lib/settings-handler.js

@@ -58,6 +58,15 @@ const SETTING_KEYS = [
         type: 'duration',
         constKey: 'MAX_AUTOREPLY_INTERVAL',
         schema: Joi.number()
+    },
+
+    {
+        key: 'const:asp:limit',
+        name: 'ASP limit',
+        description: 'How many application passwords users can register',
+        type: 'number',
+        constKey: 'MAX_ASP_COUNT',
+        schema: Joi.number()
     }
 ];
 

lib/user-handler.js

@@ -1144,12 +1144,13 @@ class UserHandler {
             throw err;
         }
 
-        if (existingASPCount >= consts.MAX_ASP_COUNT) {
+        let maxASPCount = await this.settingsHandler.get('const:asp:limit');
+        if (existingASPCount >= maxASPCount) {
             let err = new Error('Maximum application password limit reached');
             err.responseCode = 403;
             err.code = 'TooMany';
             err.details = {
-                allowed: consts.MAX_ASP_COUNT
+                allowed: maxASPCount
             };
             throw err;
         }