| import { createHash, timingSafeEqual } from "node:crypto"; | |
| /** | |
| * Checks `Authorization: Bearer $ADMIN_TOKEN`. Returns "disabled" when no token is | |
| * configured so the admin routes can answer 404 and stay invisible. | |
| */ | |
| export function checkAdmin(request: Request): "ok" | "denied" | "disabled" { | |
| const expected = process.env.ADMIN_TOKEN; | |
| if (!expected) return "disabled"; | |
| const header = request.headers.get("authorization") ?? ""; | |
| const provided = header.startsWith("Bearer ") ? header.slice(7) : ""; | |
| // Hash both sides so the comparison has equal length and does not leak it. | |
| const a = createHash("sha256").update(provided).digest(); | |
| const b = createHash("sha256").update(expected).digest(); | |
| return timingSafeEqual(a, b) ? "ok" : "denied"; | |
| } | |
| export function adminDenied(result: "denied" | "disabled") { | |
| return result === "disabled" | |
| ? Response.json({ error: "Not found." }, { status: 404 }) | |
| : Response.json({ error: "Unauthorized." }, { status: 401 }); | |
| } | |