George Lambert
d8efffe8be
Some checks are pending
offline / test (push) Waiting to run
verae-staff-ui holds one review template for CS and access-staff. Staff cookies take STAFF_COOKIE_DOMAIN for a reverse-proxy host. /docs stays vendor Swagger with an integrator banner only.
32 lines
917 B
JavaScript
32 lines
917 B
JavaScript
import crypto from 'node:crypto';
|
|
|
|
export function staffKey() {
|
|
return process.env.STAFF_KEY || process.env.ADMIN_KEY || 'admin-dev-key';
|
|
}
|
|
|
|
export function sessionToken() {
|
|
return crypto.createHmac('sha256', staffKey()).update('verae-staff').digest('hex');
|
|
}
|
|
|
|
export function cookieHeader() {
|
|
let s = `staff_session=${sessionToken()}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`;
|
|
const domain = process.env.STAFF_COOKIE_DOMAIN;
|
|
if (domain) s += `; Domain=${domain}`;
|
|
if (process.env.STAFF_COOKIE_SECURE === '1') s += '; Secure';
|
|
return s;
|
|
}
|
|
|
|
export function cookieOk(req) {
|
|
const raw = req.headers?.cookie || '';
|
|
const m = /(?:^|; )staff_session=([^;]+)/.exec(raw);
|
|
return Boolean(m && m[1] === sessionToken());
|
|
}
|
|
|
|
export function headerOk(req) {
|
|
const k = req.headers?.['x-staff-key'];
|
|
return k === staffKey();
|
|
}
|
|
|
|
export function allowed(req) {
|
|
return cookieOk(req) || headerOk(req);
|
|
}
|