b3eaeb7287
middleware.ts previously 404'd every external request, which meant the app was unusable once hosted. There are no per-user accounts, so this adds a single-password gate: - /login page + POST /api/auth/login, POST /api/auth/logout - lib/auth.ts: HMAC-SHA256 signed session cookie (lib/auth), Web Crypto only so the same code runs in Edge middleware and Node handlers - middleware now admits: the signing flow (unchanged, still public), /login + /api/auth/*, local requests, and valid sessions. Everything else redirects to /login (pages) or returns 401 JSON (API calls). - password compared with a constant-time compare, wrong attempts delayed 600ms to slow online guessing - cookie is HttpOnly + SameSite=Lax, 12h, Secure when x-forwarded-proto says https (Coolify serves the proxy on http today) APP_PASSWORD / AUTH_SECRET added to .env.example, with a warning: an unquoted # in an env value starts a comment, which silently truncated the first generated password and made login fail. Verified against a real built server: anon->307 /login, anon API->401, wrong password->401, correct password->200+cookie, signed-in request reaches PocketBase, /resign/ still 200 without a cookie, forged cookie->401.
13 lines
No EOL
416 B
TypeScript
13 lines
No EOL
416 B
TypeScript
// app/api/auth/logout/route.ts
|
|
// POST — clears the session cookie.
|
|
|
|
import { NextRequest, NextResponse } from "next/server";
|
|
import { SESSION_COOKIE, sessionCookieOptions } from "@/lib/auth";
|
|
|
|
export const dynamic = "force-dynamic";
|
|
|
|
export async function POST(req: NextRequest) {
|
|
const res = NextResponse.json({ ok: true });
|
|
res.cookies.set(SESSION_COOKIE, "", sessionCookieOptions(req, 0));
|
|
return res;
|
|
} |