George Lambert
9cc0018708
Some checks are pending
offline / test (push) Waiting to run
Account-balance stores display names and looks up by name. Edge writes names on customer create/edit; staff UIs join from edge when needed. New verae-staff-session issues a host cookie; department HTML redirects when STAFF_AUTH=1. JOBS_EVENTS_EXCLUSIVE lets jobs-events own the durable consumer. Catalog index is cards; disabled fleet machines are grey.
28 lines
749 B
JavaScript
28 lines
749 B
JavaScript
import crypto from 'node:crypto';
|
|
|
|
export function staffKey() {
|
|
return process.env.STAFF_KEY || process.env.ADMIN_KEY || 'admin-dev-key';
|
|
}
|
|
|
|
export function sessionToken() {
|
|
return crypto.createHmac('sha256', staffKey()).update('verae-staff').digest('hex');
|
|
}
|
|
|
|
export function cookieHeader() {
|
|
return `staff_session=${sessionToken()}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`;
|
|
}
|
|
|
|
export function cookieOk(req) {
|
|
const raw = req.headers?.cookie || '';
|
|
const m = /(?:^|; )staff_session=([^;]+)/.exec(raw);
|
|
return Boolean(m && m[1] === sessionToken());
|
|
}
|
|
|
|
export function headerOk(req) {
|
|
const k = req.headers?.['x-staff-key'];
|
|
return k === staffKey();
|
|
}
|
|
|
|
export function allowed(req) {
|
|
return cookieOk(req) || headerOk(req);
|
|
}
|