enricobuehler
9856c04b75
ci / rust (push) Has been cancelled
Single-user, LAN-reachable-but-gated. The web server is a backend-for-frontend:
- Login: POST /_auth/login {password} checks PUNKTFUNK_UI_PASSWORD (constant-time) and
sets a SEALED session cookie (h3 useSession / AES-GCM). server/middleware/auth.ts gates
every request — pages 302 → /login, /api → 401 — and FAILS CLOSED (503) when
PUNKTFUNK_UI_PASSWORD is unset, so a misconfigured LAN-exposed server admits no one.
- The management API stays loopback-only + token (never LAN-exposed). The proxy
(server/routes/api/[...].ts) injects PUNKTFUNK_MGMT_TOKEN server-side and drops the
browser's cookie before forwarding — the token never reaches the browser, which only
holds the session cookie.
Nitro doesn't auto-scan a server/ dir, so the Nitro plugin gets an explicit scanDirs to
pick up middleware + routes. Client: removed the localStorage token (server injects it);
the fetcher bounces to /login on 401; new /login page (bare, no shell); Settings drops the
token field and gains a Sign-out button; en/de strings.
Validated live end to end: unauth /→302, /api→401; wrong pw→401; right pw→200+cookie;
authed /api/v1/status→200 (proxied, mgmt token injected — the host required it); logout→
session cleared→401. tsc + build green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
21 lines
951 B
TypeScript
21 lines
951 B
TypeScript
// POST /_auth/login {password} — verify the shared password (constant-time), then seal an
|
|
// authenticated session cookie. Public (allowlisted in the gate) so an unauthenticated user
|
|
// can actually log in.
|
|
import { defineEventHandler, readBody, createError, useSession } from 'h3'
|
|
import { sessionConfig, timingSafeEqual, uiPassword, type SessionData } from '../../util/auth'
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
const expected = uiPassword()
|
|
if (!expected) {
|
|
throw createError({ statusCode: 503, statusMessage: 'auth not configured' })
|
|
}
|
|
const body = await readBody<{ password?: string }>(event)
|
|
const password = String(body?.password ?? '')
|
|
if (!timingSafeEqual(password, expected)) {
|
|
throw createError({ statusCode: 401, statusMessage: 'invalid password' })
|
|
}
|
|
const session = await useSession<SessionData>(event, sessionConfig())
|
|
await session.update({ authenticated: true })
|
|
return { ok: true }
|
|
})
|