Spaces:
Running
Running
| import './server-tls'; | |
| import {createCipheriv,createDecipheriv,randomBytes,createHash} from 'node:crypto'; | |
| import {cookies} from 'next/headers'; | |
| export const SESSION_COOKIE='kiku-session'; | |
| export const FLOW_COOKIE='kiku-oauth'; | |
| export const CLIENT_ID=process.env.HF_OAUTH_CLIENT_ID||'https://reubencf-kiku-engine.hf.space/.well-known/oauth-cimd'; | |
| type Session={token:string;expires:number;user:{id:string;name:string}}; | |
| export type OAuthFlow={state:string;verifier:string;expires:number;popup?:boolean;next?:string}; | |
| /** Pages sign-in may return to. A fixed list, so the parameter can never become an open redirect. */ | |
| const RETURNS=new Set(['/','/score']); | |
| export const returnPath=(value:string|null)=>value&&RETURNS.has(value)?value:'/'; | |
| const devGlobal=globalThis as typeof globalThis & {kikuSessionKey?:Buffer}; | |
| function key(){ | |
| const secret=process.env.SESSION_SECRET; | |
| if(secret){if(!/^[a-f\d]{64}$/i.test(secret))throw new Error('SESSION_SECRET must contain 32 random bytes encoded as hex.');return Buffer.from(secret,'hex');} | |
| if(process.env.NODE_ENV==='production')throw new Error('SESSION_SECRET is required.'); | |
| return devGlobal.kikuSessionKey??=(randomBytes(32)); | |
| } | |
| export function seal(value:unknown){ | |
| const iv=randomBytes(12),cipher=createCipheriv('aes-256-gcm',key(),iv); | |
| const encrypted=Buffer.concat([cipher.update(JSON.stringify(value),'utf8'),cipher.final()]); | |
| return Buffer.concat([iv,cipher.getAuthTag(),encrypted]).toString('base64url'); | |
| } | |
| export function unseal<T>(value?:string):T|null{ | |
| if(!value)return null; | |
| try{const bytes=Buffer.from(value,'base64url');if(bytes.length<29)return null; | |
| const decipher=createDecipheriv('aes-256-gcm',key(),bytes.subarray(0,12));decipher.setAuthTag(bytes.subarray(12,28)); | |
| return JSON.parse(Buffer.concat([decipher.update(bytes.subarray(28)),decipher.final()]).toString('utf8')) as T; | |
| }catch{return null;} | |
| } | |
| export function appOrigin(){ | |
| const configured=process.env.APP_ORIGIN||(process.env.SPACE_HOST?'https://'+process.env.SPACE_HOST:undefined); | |
| if(!configured&&process.env.NODE_ENV==='production')throw new Error('APP_ORIGIN is required.'); | |
| return new URL(configured||'http://localhost:3000').origin; | |
| } | |
| export function cookieOptions(maxAge:number){return {httpOnly:true,secure:appOrigin().startsWith('https:'),sameSite:'lax' as const,path:'/',maxAge};} | |
| export async function session(){ | |
| const value=unseal<Session>((await cookies()).get(SESSION_COOKIE)?.value); | |
| return value&&typeof value.token==='string'&&value.expires>Date.now()&&value.user?.id?value:null; | |
| } | |
| export async function authorize(req:Request){ | |
| const user=await session(); | |
| if(!user)return {error:Response.json({error:'Sign in with Hugging Face to continue.',signIn:true},{status:401})} as const; | |
| if(req.method!=='GET'&&(req.headers.get('origin')!==appOrigin()||req.headers.get('sec-fetch-site')==='cross-site')) | |
| return {error:Response.json({error:'Please submit from Kiku AI.'},{status:403})} as const; | |
| return {session:user} as const; | |
| } | |
| export function createFlow(popup=false,next='/'):OAuthFlow{return {state:randomBytes(32).toString('base64url'),verifier:randomBytes(32).toString('base64url'),expires:Date.now()+600000,popup,next};} | |
| export function challenge(verifier:string){return createHash('sha256').update(verifier).digest('base64url');} | |