George Lambert
9cc0018708
Some checks are pending
offline / test (push) Waiting to run
Account-balance stores display names and looks up by name. Edge writes names on customer create/edit; staff UIs join from edge when needed. New verae-staff-session issues a host cookie; department HTML redirects when STAFF_AUTH=1. JOBS_EVENTS_EXCLUSIVE lets jobs-events own the durable consumer. Catalog index is cards; disabled fleet machines are grey.
14 lines
689 B
JavaScript
14 lines
689 B
JavaScript
import { allowed } from './token.js';
|
|
|
|
/** Redirect HTML to the staff login when STAFF_AUTH=1. JSON APIs stay open unless STAFF_AUTH_JSON=1. */
|
|
export function staffHtmlGuard(req, res, url) {
|
|
if (process.env.STAFF_AUTH !== '1') return false;
|
|
const html = req.method === 'GET' && (url.pathname === '/' || url.pathname === '/index.html');
|
|
if (!html) return false;
|
|
if (allowed(req)) return false;
|
|
const login = (process.env.STAFF_SESSION_URL || 'http://127.0.0.1:3027').replace(/\/$/, '');
|
|
const next = `http://${req.headers.host || '127.0.0.1'}${url.pathname}`;
|
|
res.writeHead(302, { location: `${login}/login?next=${encodeURIComponent(next)}` });
|
|
res.end();
|
|
return true;
|
|
}
|