import { deleteCookie, getCookies, setCookie } from "https://deno.land/std/http/cookie.ts"; import { inferRequestVal } from "https://esm.town/v/andreterron/inferRequestVal?v=2"; import { sqlite } from "https://esm.town/v/std/sqlite?v=4"; import { html } from "https://esm.town/v/stevekrouse/html?v=5"; import { zip } from "npm:lodash-es"; import { nanoid } from "npm:nanoid"; type Session = { id: string; expiresAt: number; }; async function createSessionTable(tableName: string) { await sqlite.execute(`CREATE TABLE ${tableName} ( id TEXT NOT NULL PRIMARY KEY, expires_at INTEGER NOT NULL, val_slug STRING NOT NULL );`); } async function createSession(tableName: string, valSlug: string): Promise { try { const expires_at = new Date(); expires_at.setDate(expires_at.getDate() + 7); const session: Session = { id: nanoid(), expiresAt: expires_at.getTime() }; await sqlite.execute({ sql: `INSERT INTO ${tableName} (id, val_slug, expires_at) VALUES (?, ?, ?)`, args: [session.id, valSlug, session.expiresAt], }); return session; } catch (e) { if (e.message.includes("no such table")) { await createSessionTable(tableName); return createSession(tableName, valSlug); } throw e; } } async function getSession(tableName: string, sessionID: string, valSlug: string): Promise { try { const { rows, columns } = await sqlite.execute({ sql: `SELECT * FROM ${tableName} WHERE id = ? AND val_slug = ?`, args: [sessionID, valSlug], }); if (rows.length == 0) { return null; } return Object.fromEntries(zip(columns, rows.at(0))) as Session; } catch (e) { if (e.message.includes("no such table")) { return null; } throw e; } } async function fetchUser(token: string): Promise<{ id: string }> { const resp = await fetch("https://api.val.town/v1/me", { headers: { Authorization: `Bearer ${token}`, }, }); if (resp.status !== 200) { throw new Error("Could not fetch user"); } return resp.json(); } async function verifyApiToken(token: string) { try { const [currentUser, requestUser] = await Promise.all([fetchUser(Deno.env.get("valtown")), fetchUser(token)]); return currentUser.id == requestUser.id; } catch (_) { return false; } } const loginPage = (handle) => `

This val website is protected by a password.

If you are @${handle}, you can access it using an API token.

If not, you'll need to contact the author for access.

`; export function redirect(location: string): Response { return new Response(null, { headers: { location, }, status: 302, }); } type Handler = (req?: Request) => Response | Promise; type PasswordAuthOptions = { password: string | string[]; sessionTable?: string; }; const cookieName = "auth_session"; export function passwordAuth(next, options?: PasswordAuthOptions) { let passwords: string[]; if (!options?.password) { passwords = []; } else if (typeof options?.password == "string") { passwords = [options.password]; } else { passwords = options.password; } const sessionTable = options?.sessionTable || "password_auth_session"; return async (req: Request) => { const val = inferRequestVal(req); const valSlug = `${val.handle}/${val.name}`; const url = new URL(req.url); if (url.pathname == "/signin" && req.method == "GET") { return html(loginPage(val.handle)); } if (url.pathname == "/signin" && req.method == "POST") { const formData = await req.formData(); const password = formData.get("password") as string; if (!passwords.includes(password) && !(await verifyApiToken(password))) { return new Response("Unauthorized", { status: 403, }); } const session = await createSession(sessionTable, valSlug); const res = redirect(url.searchParams.get("redirect") || "/"); setCookie(res.headers, { name: cookieName, value: session.id, maxAge: session.expiresAt, httpOnly: true, secure: true, // to work in val.town iframes sameSite: "None", }); return res; } if (url.pathname == "/signout") { const res = redirect("/signin"); deleteCookie(res.headers, cookieName); return res; } const sessionID = getCookies(req.headers)[cookieName]; if (!sessionID) { return redirect("/signin"); } const session = await getSession(sessionTable, sessionID, valSlug); if (!session) { const res = redirect(`/signin`); deleteCookie(res.headers, cookieName); return res; } if (session.expiresAt < Date.now()) { const res = redirect(`/signin`); deleteCookie(res.headers, cookieName); return res; } return next(req); }; }