93 lines
3.0 KiB
TypeScript
93 lines
3.0 KiB
TypeScript
/**
|
||
* 后台管理员登录鉴权：生成/校验签名 Cookie，不暴露账号密码
|
||
* 账号密码从环境变量读取，默认 admin / key123456（与 .cursorrules 一致）
|
||
*/
|
||
|
||
import { createHmac, timingSafeEqual } from 'crypto'
|
||
|
||
const COOKIE_NAME = 'admin_session'
|
||
const MAX_AGE_SEC = 7 * 24 * 3600 // 7 天
|
||
const SECRET = process.env.ADMIN_SESSION_SECRET || 'soul-admin-secret-change-in-prod'
|
||
|
||
export function getAdminCredentials() {
|
||
return {
|
||
username: process.env.ADMIN_USERNAME || 'admin',
|
||
password: process.env.ADMIN_PASSWORD || 'key123456',
|
||
}
|
||
}
|
||
|
||
export function verifyAdminCredentials(username: string, password: string): boolean {
|
||
const { username: u, password: p } = getAdminCredentials()
|
||
return username === u && password === p
|
||
}
|
||
|
||
function sign(payload: string): string {
|
||
return createHmac('sha256', SECRET).update(payload).digest('base64url')
|
||
}
|
||
|
||
/** 生成签名 token，写入 Cookie 用 */
|
||
export function createAdminToken(): string {
|
||
const exp = Math.floor(Date.now() / 1000) + MAX_AGE_SEC
|
||
const payload = `${exp}`
|
||
const sig = sign(payload)
|
||
return `${payload}.${sig}`
|
||
}
|
||
|
||
/** 校验 Cookie 中的 token */
|
||
export function verifyAdminToken(token: string | null | undefined): boolean {
|
||
if (!token || typeof token !== 'string') return false
|
||
const dot = token.indexOf('.')
|
||
if (dot === -1) return false
|
||
const payload = token.slice(0, dot)
|
||
const sig = token.slice(dot + 1)
|
||
const exp = parseInt(payload, 10)
|
||
if (Number.isNaN(exp) || exp < Math.floor(Date.now() / 1000)) return false
|
||
const expected = sign(payload)
|
||
if (typeof expected !== 'string' || typeof sig !== 'string') return false
|
||
if (sig.length !== expected.length) return false
|
||
try {
|
||
return timingSafeEqual(Buffer.from(sig, 'base64url'), Buffer.from(expected, 'base64url'))
|
||
} catch {
|
||
return false
|
||
}
|
||
}
|
||
|
||
export function getAdminCookieName() {
|
||
return COOKIE_NAME
|
||
}
|
||
|
||
export function getAdminCookieOptions() {
|
||
return {
|
||
httpOnly: true,
|
||
secure: process.env.NODE_ENV === 'production',
|
||
sameSite: 'lax' as const,
|
||
maxAge: MAX_AGE_SEC,
|
||
path: '/',
|
||
}
|
||
}
|
||
|
||
/** 从请求中读取 admin cookie 并校验，未通过时返回 null */
|
||
export function getAdminTokenFromRequest(request: Request): string | null {
|
||
const cookieHeader = request.headers.get('cookie')
|
||
if (!cookieHeader) return null
|
||
const name = COOKIE_NAME + '='
|
||
const start = cookieHeader.indexOf(name)
|
||
if (start === -1) return null
|
||
const valueStart = start + name.length
|
||
const end = cookieHeader.indexOf(';', valueStart)
|
||
const value = end === -1 ? cookieHeader.slice(valueStart) : cookieHeader.slice(valueStart, end)
|
||
return value.trim() || null
|
||
}
|
||
|
||
/** 若未登录则返回 401 Response，供各 admin API 使用 */
|
||
export function requireAdminResponse(request: Request): Response | null {
|
||
const token = getAdminTokenFromRequest(request)
|
||
if (!verifyAdminToken(token)) {
|
||
return new Response(JSON.stringify({ error: '未授权访问，请先登录' }), {
|
||
status: 401,
|
||
headers: { 'Content-Type': 'application/json' },
|
||
})
|
||
}
|
||
return null
|
||
}
|