Spaces:
Sleeping
Sleeping
| import type { Request, Response, NextFunction } from 'express'; | |
| import { validateSession } from '../services/auth.js'; | |
| import { isTrustedRequest } from '../lib/ip-trust.js'; | |
| // Gate the /api/* admin surface behind a dashboard session (#35, item #2). | |
| // The token is the opaque session token issued by /api/auth/login|setup, sent | |
| // as `Authorization: Bearer <token>`. The /v1 proxy is NOT gated by this — it | |
| // keeps its own unified-API-key auth for app clients. | |
| // | |
| // Single-user convenience: a caller whose source IP is on the local machine or | |
| // the local network (loopback, RFC1918, link-local, IPv6 ULA / link-local) is | |
| // treated as already authenticated. The dashboard is intended for one operator | |
| // on a trusted network, so the login form is suppressed for those callers. | |
| // Remote callers still need a valid session token. See server/src/lib/ip-trust.ts | |
| // for the full policy and its limitations. | |
| export function requireAuth(req: Request, res: Response, next: NextFunction): void { | |
| if (isTrustedRequest(req)) { | |
| next(); | |
| return; | |
| } | |
| const token = req.headers.authorization?.replace(/^Bearer\s+/i, '') | |
| ?? (req.headers['x-dashboard-token'] as string | undefined); | |
| const session = validateSession(token); | |
| if (!session) { | |
| res.status(401).json({ error: { message: 'Authentication required', type: 'authentication_error' } }); | |
| return; | |
| } | |
| (req as Request & { user?: typeof session }).user = session; | |
| next(); | |
| } | |