Brendan Chen
6d8fb9105d
- Fix tsconfig: switch to ESNext/Bundler module resolution (tsx compatible) - Sanitize file extensions against path traversal (^.[a-zA-Z0-9]+$ only) - Sanitize Content-Disposition filename to prevent header injection - Extract tokenCookieOptions helper to eliminate duplication across auth handlers - Remove unused baseUrl param from fileListPage - Add Dockerfile (multi-stage build with alpine + native tools for bcrypt) - Add docker-compose.yml with named volume for data persistence - Add .env.example with all environment variables documented Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
50 lines
1.7 KiB
TypeScript
50 lines
1.7 KiB
TypeScript
import type { FastifyPluginAsync } from 'fastify';
|
|
import type Database from 'better-sqlite3';
|
|
import type { Config } from '../../../config.ts';
|
|
import type { Logger } from '../../../middleware/logging.ts';
|
|
import { getUserByUsername } from '../../../db/users.ts';
|
|
import { verifyPassword } from '../../../services/auth.ts';
|
|
import { requireAuth, tokenCookieOptions } from '../../../middleware/auth.ts';
|
|
|
|
interface Deps {
|
|
db: Database.Database;
|
|
config: Config;
|
|
logger: Logger;
|
|
}
|
|
|
|
interface LoginBody {
|
|
username: string;
|
|
password: string;
|
|
}
|
|
|
|
export const authApiRoutes: FastifyPluginAsync<{ deps: Deps }> = async (app, { deps }) => {
|
|
const { db, config, logger } = deps;
|
|
|
|
app.post<{ Body: LoginBody }>('/login', async (request, reply) => {
|
|
const { username, password } = request.body ?? {};
|
|
const ip = request.ip;
|
|
const userAgent = request.headers['user-agent'] ?? '';
|
|
|
|
if (!username || !password) {
|
|
return reply.status(400).send({ error: 'username and password are required' });
|
|
}
|
|
|
|
const user = getUserByUsername(db, username);
|
|
const valid = user ? await verifyPassword(password, user.password_hash) : false;
|
|
|
|
if (!user || !valid) {
|
|
await logger.authFailure({ ip, userAgent, username });
|
|
return reply.status(401).send({ error: 'Invalid credentials' });
|
|
}
|
|
|
|
await logger.authSuccess({ ip, userAgent, username });
|
|
|
|
const token = app.jwt.sign({ sub: user.id, username: user.username }, { expiresIn: config.jwtExpiry });
|
|
reply.setCookie('token', token, tokenCookieOptions(config.cookieSecure)).send({ ok: true });
|
|
});
|
|
|
|
app.post('/logout', { preHandler: requireAuth }, async (_request, reply) => {
|
|
reply.clearCookie('token', { path: '/' }).send({ ok: true });
|
|
});
|
|
};
|