This website is protected behind a password.

\n \n

\n \n`;\n\nexport function redirect(location: string): Response {\n return new Response(null, {\n headers: {\n location,\n },\n status: 302,\n });\n}\n\ntype Handler = (req?: Request) => Response | Promise;\n\ntype PasswordAuthOptions = {\n verifyPassword: (password: string) => boolean | Promise;\n sessionTable?: string;\n};\n\nconst cookieName = \"auth_session\";\n\nexport function passwordAuth(next, options?: PasswordAuthOptions) {\n const sessionTable = options?.sessionTable || \"password_auth_session\";\n return async (req: Request) => {\n const val = inferRequestVal(req);\n const valSlug = `${val.handle}/${val.name}`;\n\n const url = new URL(req.url);\n if (url.pathname == \"/signin\" && req.method == \"GET\") {\n return html(loginPage);\n }\n\n if (url.pathname == \"/signin\" && req.method == \"POST\") {\n const formData = await req.formData();\n const password = formData.get(\"password\") as string;\n if (!await options.verifyPassword(password)) {\n return new Response(\"Unauthorized\", {\n status: 403,\n });\n }\n const session = await createSession(sessionTable, valSlug);\n const res = redirect(url.searchParams.get(\"redirect\") || \"/\");\n setCookie(res.headers, {\n name: cookieName,\n value: session.id,\n maxAge: session.expiresAt,\n httpOnly: true,\n secure: true,\n // to work in val.town iframes\n sameSite: \"None\",\n });\n\n return res;\n }\n\n if (url.pathname == \"/signout\") {\n const res = redirect(\"/signin\");\n deleteCookie(res.headers, cookieName);\n return res;\n }\n\n if (req.headers.has(\"Authorization\")) {\n const requestToken = req.headers.get(\"Authorization\").replace(\"Bearer \", \"\").trim();\n if (!await options.verifyPassword(requestToken)) {\n return new Response(null, {\n status: 403,\n });\n }\n return next(req);\n }\n\n const sessionID = getCookies(req.headers)[cookieName];\n if (!sessionID) {\n return redirect(\"/signin\");\n }\n\n const session = await getSession(sessionTable, sessionID, valSlug);\n if (!session) {\n const res = redirect(`/signin`);\n deleteCookie(res.headers, cookieName);\n return res;\n }\n\n if (session.expiresAt < Date.now()) {\n const res = redirect(`/signin`);\n deleteCookie(res.headers, cookieName);\n return res;\n }\n\n return next(req);\n };\n}","createdAt",["D",1725934464695],"version","currentUserHasLiked","likeCount","forkCount","referenceCount","dependencyCount",3,"commentCount","prCount","mergedPr",{"_132":133,"_134":135},"handle","sboesen","profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18ybGlSNXN1T2dMbDRLVFRzdmJWZWd2cjB1aDkifQ","forkedVal",{"_116":138,"_132":139,"_100":101,"_121":140,"_141":-5},"a84f22e0-3318-11ef-8466-cab58f78796a","pomdtr",87,"prDisabledHint","fileId","02ac18b8-27b7-11f0-aecd-569c3dd06744","interval","slug","sboesen/password_auth","description","Password Auth Middleware Protect your vals behind a password. Use session cookies to persist authentication. Demo See @pomdtr/password_auth_test Usage import { passwordAuth } from \"https://esm.town/v/pomdtr/password_auth?v=84\";\n\nexport default passwordAuth(() => {\n return new Response(\"OK\");\n}, { verifyPassword: (password) => password == Deno.env.get(\"VAL_PASSWORD\") }); If you want to use an api token to authenticate: import { passwordAuth } from \"https://esm.town/v/pomdtr/password_auth?v=84\";\nimport { verifyToken } from \"https://esm.town/v/pomdtr/verifyToken\";\n\nexport default passwordAuth(() => {\n return new Response(\"OK\");\n}, { verifyPassword: verifyToken }); TODO [x] allow to authenticate using a val town token [ ] add a way to send an email to ask a password from the val owner [ ] automatically extend the session [ ] automatically remove expired sessions FAQ How to sign out ? Navigate to /signout .","versions",[151],{"_121":31,"_152":-5,"_119":153,"_116":114},"prId",["D",1725934464695],"routes/embed","actionData","errors"]