lerufic/heimdall repository overview

⁠

⁠ Heimdall HTTP Approval Platform

Heimdall is a secure, role-based HTTP Request Management and Execution platform built with Next.js 16. It acts as an intermediate approval layer for sensitive internal API requests, requiring designated approvers to vet payloads before they are physically executed on the backend network.

⁠🌟 Core Features

• Flexible Authentication: Natively supports both legacy Active Directory / LDAP and modern Enterprise SSO (OpenID Connect via Google, Keycloak, Auth0) out-of-the-box using a simple AUTH_MODE toggle.
• Role-Based Access Control (RBAC): Users are systematically classified strictly as REQUESTER or APPROVER dynamically via whitelist environment constraints.
• Granular Payload Construction: Full GUI support for mapping URL search parameters, Header key-values (with dynamic Basic/Bearer Auth injection), and raw JSON bodies. Structured JSON Audit Trails: A zero-dependency metadata flattening logger outputs strictly formatted non-nested JSON strings natively to stdout across all endpoint lifecycles—making Heimdall instantly plug-and-play with scraping infrastructures like Datadog, ELK, or Loki.
• Request Cloning: Easily clone and mutate existing/historical requests into new drafts natively from the dashboard.
• Execution Telemetry: Once an approved request is successfully executed by the server, the raw payload response and corresponding network latency mapped via performance.now() are permanently attached to the ticket for post-mortem inspection.

⁠📷 Screenshots

⁠🛠 Tech Stack

• Framework: Next.js 16 (App Router + React)
• Styling: Tailwind CSS
• Database: Prisma ORM with SQLite backend (Easily swappable to Postgres/MySQL)
• Authentication: Dual-mode engine utilizing ldap-authentication for Active Directory and vanilla fetch() + jose for pure natively validated OAuth2 (OIDC) JSON Web Tokens.

⁠🚀 QuickStart (Local Development)

1. Install Dependencies

   npm install
   

   Copy

2. Configure Environment Copy .env.example to .env (or create a .env file natively) and populate your database architecture alongside your AD/LDAP variables:

   # Database Configuration
   DATABASE_URL="file:./dev.db"
   
   # Flexible Environment Toggles
   AUTH_MODE="LDAP"  # Choose strictly "LDAP" or "SSO"
   
   # LDAP / Authentication Configuration
   MOCK_LDAP="true"  # Set to false to bind to real LDAP instances
   LDAP_URL="ldap://your-server:389"
   LDAP_SEARCH_FILTER="(|(sAMAccountName=%s)(userPrincipalName=%s))"
   
   # OIDC Configuration (If AUTH_MODE="SSO")
   OAUTH_CLIENT_ID="your-client-id"
   OAUTH_CLIENT_SECRET="your-client-secret"
   OAUTH_AUTH_URL="https://accounts.google.com/o/oauth2/v2/auth"
   OAUTH_TOKEN_URL="https://oauth2.googleapis.com/token"
   OAUTH_REDIRECT_URI="http://localhost:3000/api/auth/callback"
   
   # Security Roles
   APPROVERS="admin,supervisor.name"
   

   Copy

3. Sync Database Architecture

   npx prisma db push
   

   Copy

4. Launch Application

   npm run dev
   

   Copy

⁠🐳 Docker Production Deployment

The repository contains a fully structured Dockerfile to seamlessly host the server on any infrastructure without local dependencies.

1. Build the container natively:

   docker build -t heimdall-platform .
   

   Copy

2. Run the secure instance:

   docker run -p 3000:3000 --env-file .env -d heimdall-platform
   

   Copy

⁠🔒 Security Notes

• Session Integrity: The system securely manages stateless session cookies globally.
• Environment Strictness: Unless FORCE_HTTPS=true is set, development setups natively bypass the "Secure" flag on cookies allowing local infrastructure hosting across IP networks.
• HMR Strictness: Turbopack inherently isolates socket headers. If you are developing over a network, next.config.ts dynamically scans node hardware IP paths internally to allow hot-reloading anywhere on the VM array natively.