Ryan Malloy
4c82487e0e
Ship an Astro middleware (src/middleware.ts) that runs on every request
and requires a valid Heady session for anything other than the login
flow itself. Previously any anonymous visitor could load /machines,
/users, /acls, /dns, /settings and the mock /api/users endpoint over
plaintext -- the SSR templates rendered as public shells and only the
front-end auth guard blocked interaction. That's a defense-in-depth
gap now that data endpoints are being wired up.
- src/middleware.ts: onRequest handler validates the heady_session
cookie via HeadySessionManager.validateSession(). Public allowlist:
/api/auth/*, /login, static assets. Unauthenticated /api/* returns
401 JSON; unauthenticated pages redirect to /api/auth/login with a
return_to query param so the OIDC round-trip lands back on the
original URL. Authenticated requests get context.locals.user set so
downstream pages can read Astro.locals.user without a second lookup.
- src/env.d.ts: type App.Locals.user as SessionUser so pages / APIs get
IDE feedback on typos.
- src/pages/{index,machines,acls,dns,users}.astro: 'export const
prerender = false' -- these pages render per-user data, they must
hit middleware on every request rather than being served as a
static file baked at build time. Without this, middleware runs
once during prerender (with no cookie) and writes a redirect as
the static HTML for the route.
- src/pages/api/{acls,users,dns/magic,dns/tailnet,settings/auth-keys}.ts:
same reason. API endpoints must be SSR so the middleware can gate
them at request time.
66 lines
1.9 KiB
TypeScript
66 lines
1.9 KiB
TypeScript
import { defineMiddleware } from 'astro:middleware';
|
|
import { getSessionManager } from './lib/auth/session-manager.js';
|
|
|
|
// Public routes — must be reachable WITHOUT a valid session so the auth
|
|
// flow itself can happen. Everything else requires authentication.
|
|
// The dashboard at `/` is intentionally NOT public: it renders real
|
|
// machine + session data. Add explicit landing/marketing paths here if
|
|
// one is added later.
|
|
const PUBLIC_API_PREFIX = '/api/auth/';
|
|
const PUBLIC_PAGE_PATHS = new Set<string>([
|
|
'/login',
|
|
'/login/',
|
|
]);
|
|
const PUBLIC_ASSET_PREFIXES = ['/assets/', '/_astro/'];
|
|
const PUBLIC_ASSET_FILES = new Set<string>([
|
|
'/favicon.svg',
|
|
'/favicon.ico',
|
|
'/robots.txt',
|
|
]);
|
|
|
|
function isPublicPath(pathname: string): boolean {
|
|
if (pathname.startsWith(PUBLIC_API_PREFIX)) return true;
|
|
if (PUBLIC_PAGE_PATHS.has(pathname)) return true;
|
|
if (PUBLIC_ASSET_FILES.has(pathname)) return true;
|
|
for (const prefix of PUBLIC_ASSET_PREFIXES) {
|
|
if (pathname.startsWith(prefix)) return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
export const onRequest = defineMiddleware(async (context, next) => {
|
|
const { pathname } = context.url;
|
|
|
|
if (isPublicPath(pathname)) {
|
|
return next();
|
|
}
|
|
|
|
const sessionMgr = getSessionManager();
|
|
const result = await sessionMgr.validateSession(context);
|
|
|
|
if (result.valid && result.user) {
|
|
context.locals.user = result.user;
|
|
return next();
|
|
}
|
|
|
|
// Unauthenticated: JSON for /api/*, redirect for pages.
|
|
if (pathname.startsWith('/api/')) {
|
|
return new Response(
|
|
JSON.stringify({
|
|
authenticated: false,
|
|
error: 'authentication_required',
|
|
reason: result.reason ?? 'missing_cookie',
|
|
login_url: '/api/auth/login',
|
|
}),
|
|
{
|
|
status: 401,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
},
|
|
);
|
|
}
|
|
|
|
const loginUrl = new URL('/api/auth/login', context.url);
|
|
loginUrl.searchParams.set('return_to', pathname + context.url.search);
|
|
return context.redirect(loginUrl.pathname + loginUrl.search, 302);
|
|
});
|