100 lines
4.0 KiB
JavaScript
100 lines
4.0 KiB
JavaScript
/* =====================================================================
|
|
gate.js — Zugangs-Schranke vor der ganzen statischen Website. 1:1 portiert aus
|
|
gate-worker.js (Cloudflare Worker), auf Express-Middleware umgestellt. Gleiche Logik:
|
|
HMAC-signierte Session-Cookies, Fail-open falls Secrets fehlen, gate.html + Assets immer
|
|
erreichbar, "/" wird intern auf "/index.html" abgebildet.
|
|
===================================================================== */
|
|
|
|
export const COOKIE_NAME = "dogi_session";
|
|
export const ROLE_COOKIE_NAME = "dogi_role";
|
|
export const SESSION_TAGE = 90;
|
|
|
|
function b64urlEncode(bytes) {
|
|
let bin = "";
|
|
bytes.forEach((b) => (bin += String.fromCharCode(b)));
|
|
return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
|
|
}
|
|
function b64urlDecodeToBytes(str) {
|
|
str = str.replace(/-/g, "+").replace(/_/g, "/");
|
|
while (str.length % 4) str += "=";
|
|
const bin = atob(str);
|
|
return Uint8Array.from(bin, (c) => c.charCodeAt(0));
|
|
}
|
|
async function hmacKey(secret) {
|
|
return crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
|
|
}
|
|
|
|
export async function signSession(role, secret) {
|
|
const payload = JSON.stringify({ role, exp: Date.now() + SESSION_TAGE * 24 * 60 * 60 * 1000 });
|
|
const payloadB64 = b64urlEncode(new TextEncoder().encode(payload));
|
|
const key = await hmacKey(secret);
|
|
const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(payloadB64));
|
|
return `${payloadB64}.${b64urlEncode(new Uint8Array(sig))}`;
|
|
}
|
|
|
|
export async function verifySession(token, secret) {
|
|
if (!token || !token.includes(".")) return null;
|
|
const [payloadB64, sigB64] = token.split(".");
|
|
try {
|
|
const key = await hmacKey(secret);
|
|
const valid = await crypto.subtle.verify("HMAC", key, b64urlDecodeToBytes(sigB64), new TextEncoder().encode(payloadB64));
|
|
if (!valid) return null;
|
|
const payload = JSON.parse(new TextDecoder().decode(b64urlDecodeToBytes(payloadB64)));
|
|
if (!payload.exp || payload.exp < Date.now()) return null;
|
|
return payload;
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
export async function gateAuthHandler(req, res) {
|
|
const body = req.body || {};
|
|
const code = (body.code || "").trim();
|
|
const next = typeof body.next === "string" && body.next.startsWith("/") && body.next !== "/" ? body.next : "/index.html";
|
|
|
|
let role = null;
|
|
if (process.env.SITE_ACCESS_CODE_DOGI && code === process.env.SITE_ACCESS_CODE_DOGI) role = "dogi";
|
|
else if (process.env.SITE_ACCESS_CODE_VANVAN && code === process.env.SITE_ACCESS_CODE_VANVAN) role = "vanvan";
|
|
|
|
if (!role) {
|
|
return res.status(401).json({ ok: false, error: "Falscher Zugangscode." });
|
|
}
|
|
|
|
const session = await signSession(role, process.env.SITE_ACCESS_SECRET);
|
|
const maxAge = SESSION_TAGE * 24 * 60 * 60 * 1000;
|
|
res.cookie(COOKIE_NAME, session, { path: "/", maxAge, httpOnly: true, secure: true, sameSite: "lax" });
|
|
res.cookie(ROLE_COOKIE_NAME, role, { path: "/", maxAge, secure: true, sameSite: "lax" });
|
|
return res.json({ ok: true, next });
|
|
}
|
|
|
|
export function gateMiddleware(req, res, next) {
|
|
const pfad = req.path;
|
|
|
|
const codesKonfiguriert = !!(process.env.SITE_ACCESS_SECRET && (process.env.SITE_ACCESS_CODE_DOGI || process.env.SITE_ACCESS_CODE_VANVAN));
|
|
if (!codesKonfiguriert) return next();
|
|
|
|
if (pfad === "/gate-auth" && req.method === "POST") {
|
|
return gateAuthHandler(req, res);
|
|
}
|
|
|
|
const sessionToken = req.cookies?.[COOKIE_NAME];
|
|
|
|
(async () => {
|
|
const payload = sessionToken ? await verifySession(sessionToken, process.env.SITE_ACCESS_SECRET) : null;
|
|
if (payload) return next();
|
|
|
|
if (
|
|
pfad === "/gate.html" ||
|
|
pfad.startsWith("/assets/") ||
|
|
pfad === "/manifest.json" ||
|
|
pfad === "/sw.js" ||
|
|
pfad === "/favicon.ico"
|
|
) {
|
|
return next();
|
|
}
|
|
|
|
const nextParam = pfad === "/" ? "/index.html" : pfad + (req.originalUrl.includes("?") ? "?" + req.originalUrl.split("?")[1] : "");
|
|
return res.redirect(302, `/gate.html?next=${encodeURIComponent(nextParam)}`);
|
|
})();
|
|
}
|