import * as cookie from "https://deno.land/std/http/cookie.ts"; import { html } from "https://esm.town/v/stevekrouse/html?v=5"; import jwt from "npm:jsonwebtoken"; const loginPage = `

`; export function redirect(location: string): Response { return new Response(null, { headers: { location, }, status: 302, }); } type User = { id: string; username: string; }; async function fetchUser(token: string): Promise { const resp = await fetch("https://api.val.town/v1/me", { headers: { Authorization: `Bearer ${token}`, }, }); if (resp.status !== 200) { throw new Error("Could not fetch user"); } return resp.json(); } async function isCurrentUser(userID: string) { const currentUser = await fetchUser(Deno.env.get("valtown")); return userID == currentUser.id; } function signout() { const res = redirect("/"); cookie.setCookie(res.headers, { name: "user-jwt", value: "", httpOnly: true, secure: true, sameSite: "None", maxAge: 0, }); return res; } export function auth(handler) { const secretKey = Deno.env.get("AUTH_SECRET_KEY"); if (!secretKey) { throw new Error("env var AUTH_SECRET_KEY not set"); } return async (req: Request) => { const { pathname, hostname, origin } = new URL(req.url); if (pathname == "/signin" && req.method == "GET") { return html(loginPage); } if (pathname == "/signin" && req.method == "POST") { const formData = await req.formData(); const token = formData.get("token").toString(); const user = await fetchUser(token); if (await isCurrentUser(user.id)) { return new Response("Unauthorized", { status: 403, }); } const webToken = jwt.sign(user, secretKey, { expiresIn: "7d" }); const res = redirect("/"); cookie.setCookie(res.headers, { name: "user-jwt", value: webToken, httpOnly: true, secure: true, sameSite: "None", }); return res; } if (pathname == "/signout") { return signout(); } const webToken = cookie.getCookies(req.headers)["user-jwt"]; if (!webToken) { return redirect("/signin"); } try { const user = jwt.verify(webToken, secretKey) as User; if (!(await isCurrentUser(user.id))) { return new Response(`Unauthorized`, { status: 403, }); } } catch (err) { return signout(); } return handler(req); }; }

auth_middleware