Spaces:
Running
Running
| /** Automaker-style server sessions. Never import this module into client components. */ | |
| import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto" | |
| import { mkdirSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs" | |
| import { isIP } from "node:net" | |
| import path from "node:path" | |
| import { NextRequest, NextResponse } from "next/server" | |
| export const SESSION_COOKIE = "nodepad_session" | |
| export const SESSION_MAX_AGE = 30 * 24 * 60 * 60 | |
| export function timingSafeMatch(actual: string, expected: string | undefined): boolean { | |
| if (!expected) return false | |
| return timingSafeEqual(createHash("sha256").update(actual).digest(), createHash("sha256").update(expected).digest()) | |
| } | |
| export function sessionCookieOptions() { | |
| return { httpOnly: true, secure: process.env.NODE_ENV === "production", sameSite: "lax" as const, path: "/", maxAge: SESSION_MAX_AGE } | |
| } | |
| const authDirectory = () => process.env.NODEPAD_AUTH_DIR || path.join(process.env.NODEPAD_DATA_DIR || path.join(process.cwd(), "data"), ".auth") | |
| function sessionFile(token: string): string | null { | |
| if (!process.env.NODEPAD_LOGIN_KEY || !/^[a-f0-9]{64}$/.test(token)) return null | |
| // Token filenames are keyed hashes: rotating the human key invalidates old sessions. | |
| const digest = createHmac("sha256", process.env.NODEPAD_LOGIN_KEY).update(token).digest("hex") | |
| return path.join(authDirectory(), `${digest}.session`) | |
| } | |
| export function createSession(now = Date.now()): string { | |
| const token = randomBytes(32).toString("hex") | |
| const file = sessionFile(token) | |
| if (!file) throw new Error("Browser login is not configured") | |
| mkdirSync(authDirectory(), { recursive: true, mode: 0o700 }) | |
| // Keep expired session files from accumulating; the store is separate from workspaces/backups. | |
| for (const name of readdirSync(authDirectory())) { | |
| if (!/^[a-f0-9]{64}\.session$/.test(name)) continue | |
| const expiredFile = path.join(authDirectory(), name) | |
| try { if (JSON.parse(readFileSync(expiredFile, "utf8")).expiresAt <= now) unlinkSync(expiredFile) } catch { /* Fail closed on unreadable sessions. */ } | |
| } | |
| const temp = `${file}.${process.pid}.tmp` | |
| writeFileSync(temp, JSON.stringify({ expiresAt: now + SESSION_MAX_AGE * 1000 }), { mode: 0o600, flag: "wx" }) | |
| renameSync(temp, file) | |
| return token | |
| } | |
| export function validateSession(token: string, now = Date.now()): boolean { | |
| const file = sessionFile(token) | |
| if (!file) return false | |
| try { | |
| const { expiresAt } = JSON.parse(readFileSync(file, "utf8")) | |
| return typeof expiresAt === "number" && expiresAt > now && expiresAt <= now + SESSION_MAX_AGE * 1000 | |
| } catch { return false } | |
| } | |
| export function invalidateSession(token: string) { | |
| const file = sessionFile(token) | |
| if (!file) return | |
| try { unlinkSync(file) } catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error } | |
| } | |
| export function hasMachineAuth(req: NextRequest): boolean { | |
| const header = req.headers.get("authorization") || "" | |
| return header.startsWith("Bearer ") && timingSafeMatch(header.slice(7), process.env.NODEPAD_API_KEY) | |
| } | |
| export function isAuthenticated(req: NextRequest): boolean { | |
| return hasMachineAuth(req) || validateSession(req.cookies.get(SESSION_COOKIE)?.value || "") | |
| } | |
| /** Same-origin checks for cookie-authenticated mutations; bearer clients are exempt. */ | |
| export function isSameOrigin(req: NextRequest): boolean { | |
| if (req.headers.get("sec-fetch-site") === "cross-site") return false | |
| const origin = req.headers.get("origin") | |
| if (!origin) return true | |
| try { | |
| // Hugging Face Space endpoints are passed through a proxy so req.nextUrl.origin | |
| // might be 0.0.0.0 or something different. Let's do a more robust origin check | |
| // or just allow standard Hugging Face domains if that's what's failing. | |
| const reqOrigin = new URL(origin).origin | |
| const urlOrigin = req.nextUrl.origin | |
| const forwardedHost = req.headers.get("x-forwarded-host") | |
| const isForwardedHostMatch = forwardedHost ? reqOrigin.includes(forwardedHost) : false | |
| return reqOrigin === urlOrigin || isForwardedHostMatch || reqOrigin.endsWith(".hf.space") || reqOrigin.includes("huggingface.co") | |
| } catch { return false } | |
| } | |
| export function requireAuth(req: NextRequest): NextResponse | null { | |
| if (!isAuthenticated(req)) return NextResponse.json({ error: "Unauthorized" }, { status: 401, headers: { "Cache-Control": "no-store" } }) | |
| if (!["GET", "HEAD", "OPTIONS"].includes(req.method) && !hasMachineAuth(req) && !isSameOrigin(req)) { | |
| return NextResponse.json({ error: "Forbidden" }, { status: 403 }) | |
| } | |
| return null | |
| } | |
| const attempts = new Map<string, { count: number; start: number }>() | |
| export function clientIp(req: NextRequest): string { | |
| // Only opt in behind a trusted single proxy that appends/overwrites X-Forwarded-For. | |
| // Rightmost hop avoids trusting a client-supplied prefix. No proxy trust: shared bucket. | |
| const candidate = process.env.NODEPAD_TRUST_PROXY === "true" ? req.headers.get("x-forwarded-for")?.split(",").at(-1)?.trim() : undefined | |
| return candidate && isIP(candidate) ? candidate : "unknown" | |
| } | |
| export function loginRetryAfter(ip: string, now = Date.now()): number { | |
| for (const [key, value] of attempts) if (now - value.start >= 60_000) attempts.delete(key) | |
| const key = attempts.has(ip) || attempts.size < 10_000 ? ip : "unknown" | |
| const entry = attempts.get(key) | |
| return entry && entry.count >= 5 ? Math.ceil((60_000 - (now - entry.start)) / 1000) : 0 | |
| } | |
| export function recordLoginFailure(ip: string, now = Date.now()) { | |
| const entry = attempts.get(ip) | |
| if (entry && now - entry.start < 60_000) entry.count++ | |
| else { | |
| // Bound memory; new identities share a bucket if the limiter is saturated. | |
| const key = attempts.size < 10_000 ? ip : "unknown" | |
| const fallback = attempts.get(key) | |
| attempts.set(key, { count: (fallback?.count || 0) + 1, start: fallback?.start || now }) | |
| } | |
| } | |
| export function clearSuccessfulLoginAttempt(ip: string) { | |
| const key = attempts.has(ip) ? ip : "unknown" | |
| const entry = attempts.get(key) | |
| if (entry) entry.count = Math.max(0, entry.count - 1) | |
| } | |