import { deleteCookie, getCookies, setCookie } from "https://deno.land/std/http/cookie.ts"; import { inferRequestVal } from "https://esm.town/v/andreterron/inferRequestVal?v=2"; import { sqlite } from "https://esm.town/v/std/sqlite?v=4"; import { html } from "https://esm.town/v/stevekrouse/html?v=5"; import { zip } from "npm:lodash-es"; import { nanoid } from "npm:nanoid"; type Session = { id: string; expiresAt: number; }; async function createSessionTable(tableName: string) { await sqlite.execute(`CREATE TABLE ${tableName} ( id TEXT NOT NULL PRIMARY KEY, expires_at INTEGER NOT NULL, val_slug STRING NOT NULL );`); } async function createSession(tableName: string, valSlug: string): Promise { try { const expires_at = new Date(); expires_at.setDate(expires_at.getDate() + 7); const session: Session = { id: nanoid(), expiresAt: expires_at.getTime() }; await sqlite.execute({ sql: `INSERT INTO ${tableName} (id, val_slug, expires_at) VALUES (?, ?, ?)`, args: [session.id, valSlug, session.expiresAt], }); return session; } catch (e) { if (e.message.includes("no such table")) { await createSessionTable(tableName); return createSession(tableName, valSlug); } throw e; } } async function getSession(tableName: string, sessionID: string, valSlug: string): Promise { try { const { rows, columns } = await sqlite.execute({ sql: `SELECT * FROM ${tableName} WHERE id = ? AND val_slug = ?`, args: [sessionID, valSlug], }); if (rows.length == 0) { return null; } return Object.fromEntries(zip(columns, rows.at(0))) as Session; } catch (e) { if (e.message.includes("no such table")) { return null; } throw e; } } const loginPage = (val) => `

This website is protected behind ${val.handle}'s Val Town API token.

If you are ${val.handle}, get your API token here.

If you are not ${val.handle}, you can fork this val to your account, and then login with your API token.

`; export function redirect(location: string): Response { return new Response(null, { headers: { location, }, status: 302, }); } type Handler = (req?: Request) => Response | Promise; type PasswordAuthOptions = { verifyPassword: (password: string) => boolean | Promise; sessionTable?: string; }; const cookieName = "auth_session"; export function passwordAuth(next, options?: PasswordAuthOptions) { const sessionTable = options?.sessionTable || "password_auth_session"; return async (req: Request) => { const val = inferRequestVal(req); const valSlug = `${val.handle}/${val.name}`; const url = new URL(req.url); if (url.pathname == "/signin" && req.method == "GET") { return html(loginPage(val)); } if (url.pathname == "/signin" && req.method == "POST") { const formData = await req.formData(); const password = formData.get("password") as string; if (!await options.verifyPassword(password)) { return new Response("Unauthorized", { status: 403, }); } const session = await createSession(sessionTable, valSlug); const res = redirect(url.searchParams.get("redirect") || "/"); setCookie(res.headers, { name: cookieName, value: session.id, maxAge: session.expiresAt, httpOnly: true, secure: true, // to work in val.town iframes sameSite: "None", }); return res; } if (url.pathname == "/signout") { const res = redirect("/signin"); deleteCookie(res.headers, cookieName); return res; } if (req.headers.has("Authorization")) { const requestToken = req.headers.get("Authorization").replace("Bearer ", "").trim(); if (!await options.verifyPassword(requestToken)) { return new Response(null, { status: 403, }); } return next(req); } const sessionID = getCookies(req.headers)[cookieName]; if (!sessionID) { return redirect("/signin"); } const session = await getSession(sessionTable, sessionID, valSlug); if (!session) { const res = redirect(`/signin`); deleteCookie(res.headers, cookieName); return res; } if (session.expiresAt < Date.now()) { const res = redirect(`/signin`); deleteCookie(res.headers, cookieName); return res; } return next(req); }; }

vtTokenSessionAuthSafe