auth.js (1728B)
1 const crypto = require('crypto'); 2 const { AUTH_PASS, AUTH_USER } = require('./config'); 3 4 // --- AUTH UTILS --- 5 const SESSION_SECRET = crypto.createHash('sha256').update(AUTH_PASS || 'default').digest('hex'); 6 7 function parseCookies(request) { 8 const list = {}; 9 const rc = request.headers.cookie; 10 if (rc) { 11 rc.split(';').forEach((cookie) => { 12 const parts = cookie.split('='); 13 list[parts.shift().trim()] = decodeURI(parts.join('=')); 14 }); 15 } 16 return list; 17 } 18 19 // Auth Middleware for APIs 20 const verifyApiToken = (req, res, next) => { 21 const authHeader = req.headers.authorization; 22 let token = req.query.token; 23 24 if (authHeader && authHeader.startsWith('Bearer ')) { 25 token = authHeader.split(' ')[1]; 26 } 27 28 if (token === SESSION_SECRET) return next(); 29 res.status(401).json({ error: 'Unauthorized' }); 30 }; 31 32 const verifyLogsAccess = (req, res, next) => { 33 let token = req.query.token; 34 if (req.headers.authorization && req.headers.authorization.startsWith('Bearer ')) { 35 token = req.headers.authorization.split(' ')[1]; 36 } 37 const cookies = parseCookies(req); 38 39 if (token === SESSION_SECRET || cookies.auth_session === SESSION_SECRET) { 40 return next(); 41 } 42 res.status(401).send('Unauthorized'); 43 }; 44 45 const checkAuth = (req, res, next) => { 46 if (!AUTH_USER || !AUTH_PASS) return next(); 47 const cookies = parseCookies(req); 48 if (cookies.auth_session === SESSION_SECRET) return next(); 49 50 if (req.path.startsWith('/api')) res.status(401).send('Unauthorized'); 51 else res.redirect('/login'); 52 }; 53 54 module.exports = { 55 SESSION_SECRET, 56 parseCookies, 57 verifyApiToken, 58 verifyLogsAccess, 59 checkAuth 60 };