marchon/verae-staff-session
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Initial import of verae-staff-session from zapier monorepo

Browse source
This commit is contained in:
George Lambert 2026-09-11 19:55:09 -04:00
commit b0f2b8a261
8 changed files with 240 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
NATS.md Normal file
View file

@ -0,0 +1,3 @@
# NATS
No subjects. HTTP cookie only.

31
README.md Normal file
View file

@ -0,0 +1,31 @@
# verae-staff-session
Shared cookie login for CS / sales / accounting / access-staff HTML.
**Forgejo:** https://git.georgelambert.org/marchon/verae-staff-session
Port `:3027`. Set `STAFF_AUTH=1` on the department servers and `STAFF_SESSION_URL=http://127.0.0.1:3027`. Cookie host is the browser host (ports share `127.0.0.1`). JSON APIs stay open unless you also send `x-staff-key`.
Default key: `STAFF_KEY` or `ADMIN_KEY` or `admin-dev-key`.
## Multiple hostnames
Cookies are host-scoped. On one operator box (`127.0.0.1`) that is enough. For several DNS names, put one reverse proxy in front and set `STAFF_COOKIE_DOMAIN`:
```nginx
server {
server_name staff.example.com;
location /session/ { proxy_pass http://127.0.0.1:3027/; }
location /cs/ { proxy_pass http://127.0.0.1:3011/; }
location /sales/ { proxy_pass http://127.0.0.1:3012/; }
location /acct/ { proxy_pass http://127.0.0.1:3013/; }
location /staff/ { proxy_pass http://127.0.0.1:3025/; }
}
```
```bash
STAFF_COOKIE_DOMAIN=.example.com
STAFF_COOKIE_SECURE=1
STAFF_SESSION_URL=https://staff.example.com/session
STAFF_AUTH=1
```

3
SUMMARY.md Normal file
View file

@ -0,0 +1,3 @@
# verae-staff-session
HMAC staff cookie (`staff_session`) so CS, sales, accounting, and access-staff HTML share one login on the operator host.

11
package.json Normal file
View file

@ -0,0 +1,11 @@
{
"name": "verae-staff-session",
"version": "0.1.0",
"private": true,
"type": "module",
"description": "Shared staff cookie login for CS / sales / accounting / access-staff HTML",
"scripts": {
"start": "node src/server.js",
"test": "node --test test/*.test.js"
}
}

14
src/gate.js Normal file
View file

@ -0,0 +1,14 @@
import { allowed } from './token.js';
/** Redirect HTML to the staff login when STAFF_AUTH=1. JSON APIs stay open unless STAFF_AUTH_JSON=1. */
export function staffHtmlGuard(req, res, url) {
if (process.env.STAFF_AUTH !== '1') return false;
const html = req.method === 'GET' && (url.pathname === '/' || url.pathname === '/index.html');
if (!html) return false;
if (allowed(req)) return false;
const login = (process.env.STAFF_SESSION_URL || 'http://127.0.0.1:3027').replace(/\/$/, '');
const next = `http://${req.headers.host || '127.0.0.1'}${url.pathname}`;
res.writeHead(302, { location: `${login}/login?next=${encodeURIComponent(next)}` });
res.end();
return true;
}

127
src/server.js Normal file
View file

@ -0,0 +1,127 @@
#!/usr/bin/env node
import http from 'node:http';
import { cookieHeader, sessionToken, staffKey } from './token.js';
const PORT = Number(process.env.PORT || 3027);
const LOGIN = `<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8"/>
<meta name="viewport" content="width=device-width, initial-scale=1"/>
<title>Staff sign-in</title>
<style>
:root { --accent:#4f46e5; --bg:#f4f5fb; --ink:#171a26; --muted:#6b7186; --line:#e5e7f0; }
* { box-sizing:border-box; }
body { margin:0; font:14px/1.45 -apple-system,"Segoe UI",sans-serif; background:var(--bg); color:var(--ink); }
#auth { min-height:100vh; display:grid; place-items:center; background:linear-gradient(160deg,#312e81 0%,#4f46e5 55%,#7c74f0 100%); }
.card { width:360px; background:#fff; border-radius:16px; padding:2rem; box-shadow:0 24px 64px rgba(17,12,60,.35); }
h1 { margin:0 0 .25rem; font-size:1.3rem; }
p { color:var(--muted); margin:0 0 1.2rem; }
label { display:block; font-size:.8rem; font-weight:700; margin:.8rem 0 .3rem; }
input { width:100%; padding:.6rem .75rem; border:1px solid var(--line); border-radius:8px; }
button { width:100%; margin-top:1.2rem; padding:.65rem; border:0; border-radius:8px; background:var(--accent); color:#fff; font-weight:700; cursor:pointer; }
.err { color:#dc2626; min-height:1.2em; }
</style>
</head>
<body>
<section id="auth">
<form class="card" method="post" action="/login">
<h1>Staff sign-in</h1>
<p>One cookie covers CS, sales, accounting, and the staff plane on this host.</p>
<input type="hidden" name="next" id="next"/>
<label for="password">Staff key</label>
<input id="password" name="password" type="password" autocomplete="current-password" required/>
<p class="err" id="err"></p>
<button type="submit">Sign in</button>
</form>
</section>
<script>
const q = new URLSearchParams(location.search);
document.getElementById('next').value = q.get('next') || '';
if (q.get('error')) document.getElementById('err').textContent = 'Wrong key.';
</script>
</body>
</html>`;
const server = http.createServer(async (req, res) => {
const url = new URL(req.url || '/', `http://127.0.0.1:${PORT}`);
const json = (code, obj) => {
res.writeHead(code, { 'content-type': 'application/json' });
res.end(JSON.stringify(obj));
};
const IAM = (process.env.STAFF_IAM_URL || '').replace(/\/$/, '');
if (IAM && req.method === 'GET' && (url.pathname === '/' || url.pathname === '/login')) {
const next = url.searchParams.get('next') || '';
res.writeHead(302, { location: `${IAM}/login?next=${encodeURIComponent(next)}` });
return res.end();
}
if (IAM && (url.pathname === '/check' || url.pathname === '/login' || url.pathname === '/logout')) {
const target = `${IAM}${url.pathname}${url.search}`;
const r = await fetch(target, {
method: req.method,
headers: { cookie: req.headers.cookie || '', authorization: req.headers.authorization || '', 'content-type': req.headers['content-type'] || '' },
body: req.method === 'GET' ? undefined : await new Promise((resolve) => {
const chunks = [];
req.on('data', (c) => chunks.push(c));
req.on('end', () => resolve(Buffer.concat(chunks)));
}),
redirect: 'manual',
});
const buf = Buffer.from(await r.arrayBuffer());
const headers = { 'content-type': r.headers.get('content-type') || 'application/json' };
const sc = r.headers.get('set-cookie');
if (sc) headers['set-cookie'] = sc;
const loc = r.headers.get('location');
if (loc) headers.location = loc;
res.writeHead(r.status, headers);
return res.end(buf);
}
if (req.method === 'GET' && url.pathname === '/health') {
return json(200, { ok: true, role: 'verae-staff-session', iam: Boolean(IAM) });
}
if (req.method === 'GET' && (url.pathname === '/' || url.pathname === '/login')) {
res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
return res.end(LOGIN);
}
if (req.method === 'GET' && url.pathname === '/check') {
const raw = req.headers.cookie || '';
const m = /(?:^|; )staff_session=([^;]+)/.exec(raw);
return json(m && m[1] === sessionToken() ? 200 : 401, { ok: Boolean(m && m[1] === sessionToken()) });
}
if (req.method === 'POST' && url.pathname === '/login') {
const chunks = [];
for await (const c of req) chunks.push(c);
const text = Buffer.concat(chunks).toString('utf8');
let password = '';
let next = '/';
if ((req.headers['content-type'] || '').includes('json')) {
const body = JSON.parse(text || '{}');
password = body.password || '';
next = body.next || '/';
} else {
const params = new URLSearchParams(text);
password = params.get('password') || '';
next = params.get('next') || '/';
}
if (password !== staffKey()) {
res.writeHead(302, { location: '/login?error=1' });
return res.end();
}
const loc = next.startsWith('http') || next.startsWith('/') ? next : '/';
res.writeHead(302, { 'set-cookie': cookieHeader(), location: loc });
return res.end();
}
if (req.method === 'POST' && url.pathname === '/logout') {
res.writeHead(302, {
'set-cookie': 'staff_session=; Path=/; Max-Age=0',
location: '/login',
});
return res.end();
}
json(404, { error: 'not found' });
});
server.listen(PORT, '0.0.0.0', () => {
process.stdout.write(`verae-staff-session http://0.0.0.0:${PORT}/\n`);
});

32
src/token.js Normal file
View file

@ -0,0 +1,32 @@
import crypto from 'node:crypto';
export function staffKey() {
return process.env.STAFF_KEY || process.env.ADMIN_KEY || 'admin-dev-key';
}
export function sessionToken() {
return crypto.createHmac('sha256', staffKey()).update('verae-staff').digest('hex');
}
export function cookieHeader() {
let s = `staff_session=${sessionToken()}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400`;
const domain = process.env.STAFF_COOKIE_DOMAIN;
if (domain) s += `; Domain=${domain}`;
if (process.env.STAFF_COOKIE_SECURE === '1') s += '; Secure';
return s;
}
export function cookieOk(req) {
const raw = req.headers?.cookie || '';
const m = /(?:^|; )staff_session=([^;]+)/.exec(raw);
return Boolean(m && m[1] === sessionToken());
}
export function headerOk(req) {
const k = req.headers?.['x-staff-key'];
return k === staffKey();
}
export function allowed(req) {
return cookieOk(req) || headerOk(req);
}

19
test/token.test.js Normal file
View file

@ -0,0 +1,19 @@
import { test } from 'node:test';
import assert from 'node:assert/strict';
import { sessionToken, cookieOk, headerOk, cookieHeader } from '../src/token.js';
test('cookie matches HMAC of staff key', () => {
const tok = sessionToken();
assert.equal(tok.length, 64);
assert.equal(cookieOk({ headers: { cookie: `staff_session=${tok}` } }), true);
assert.equal(cookieOk({ headers: { cookie: 'staff_session=nope' } }), false);
assert.equal(headerOk({ headers: { 'x-staff-key': process.env.STAFF_KEY || 'admin-dev-key' } }), true);
});
test('cookie Domain is optional', () => {
delete process.env.STAFF_COOKIE_DOMAIN;
assert.equal(cookieHeader().includes('Domain='), false);
process.env.STAFF_COOKIE_DOMAIN = '.example.com';
assert.match(cookieHeader(), /Domain=\.example.com/);
delete process.env.STAFF_COOKIE_DOMAIN;
});