Spaces:
Sleeping
Sleeping
| import { cookies } from "next/headers"; | |
| import crypto from "node:crypto"; | |
| export interface Session { | |
| accessToken: string; | |
| expiresAt: number; // epoch ms | |
| user: { | |
| name: string; // username | |
| fullName?: string; | |
| avatarUrl?: string; | |
| }; | |
| } | |
| const COOKIE_NAME = "sf_session"; | |
| function sessionKey(): Buffer { | |
| const secret = | |
| process.env.SESSION_SECRET || | |
| process.env.OAUTH_CLIENT_SECRET || | |
| "spacefactory-dev-secret"; | |
| return crypto.createHash("sha256").update(secret).digest(); | |
| } | |
| export function seal(data: unknown): string { | |
| const iv = crypto.randomBytes(12); | |
| const cipher = crypto.createCipheriv("aes-256-gcm", sessionKey(), iv); | |
| const plaintext = Buffer.from(JSON.stringify(data), "utf8"); | |
| const enc = Buffer.concat([cipher.update(plaintext), cipher.final()]); | |
| const tag = cipher.getAuthTag(); | |
| return Buffer.concat([iv, tag, enc]).toString("base64url"); | |
| } | |
| export function unseal<T>(sealed: string): T | null { | |
| try { | |
| const raw = Buffer.from(sealed, "base64url"); | |
| const iv = raw.subarray(0, 12); | |
| const tag = raw.subarray(12, 28); | |
| const enc = raw.subarray(28); | |
| const decipher = crypto.createDecipheriv("aes-256-gcm", sessionKey(), iv); | |
| decipher.setAuthTag(tag); | |
| const dec = Buffer.concat([decipher.update(enc), decipher.final()]); | |
| return JSON.parse(dec.toString("utf8")) as T; | |
| } catch { | |
| return null; | |
| } | |
| } | |
| export async function getSession(): Promise<Session | null> { | |
| const jar = await cookies(); | |
| const cookie = jar.get(COOKIE_NAME); | |
| if (!cookie?.value) return null; | |
| const session = unseal<Session>(cookie.value); | |
| if (!session) return null; | |
| if (session.expiresAt && session.expiresAt < Date.now()) return null; | |
| return session; | |
| } | |
| export function sessionCookie(session: Session) { | |
| return { | |
| name: COOKIE_NAME, | |
| value: seal(session), | |
| httpOnly: true, | |
| secure: process.env.NODE_ENV === "production", | |
| // The Space may be embedded in an iframe on huggingface.co; SameSite=None | |
| // (with Secure) keeps the session usable there. | |
| sameSite: (process.env.NODE_ENV === "production" ? "none" : "lax") as | |
| | "none" | |
| | "lax", | |
| path: "/", | |
| maxAge: Math.max(60, Math.floor((session.expiresAt - Date.now()) / 1000)), | |
| }; | |
| } | |
| export function clearedSessionCookie() { | |
| return { | |
| name: COOKIE_NAME, | |
| value: "", | |
| httpOnly: true, | |
| secure: process.env.NODE_ENV === "production", | |
| sameSite: (process.env.NODE_ENV === "production" ? "none" : "lax") as | |
| | "none" | |
| | "lax", | |
| path: "/", | |
| maxAge: 0, | |
| }; | |
| } | |