48 lines
1.8 KiB
TypeScript
48 lines
1.8 KiB
TypeScript
import { cookies } from 'next/headers';
|
|
import type { NextRequest } from 'next/server';
|
|
import { verifySetupToken } from './token';
|
|
|
|
export const SETUP_COOKIE = 'bulwark_setup_token';
|
|
const COOKIE_MAX_AGE = 60 * 60; // 1 hour, matches token TTL
|
|
|
|
/**
|
|
* The wizard "session" is just the setup token itself, set as an HttpOnly
|
|
* cookie after the operator pastes it into step 1. Subsequent step calls
|
|
* re-verify the cookie value against the .setup-token file. When the wizard
|
|
* finishes, the token file is deleted and any cookies become useless.
|
|
*
|
|
* No JWT, no separate signing key, no rotating session id. The lifecycle of
|
|
* the wizard maps 1:1 to the lifecycle of the token file.
|
|
*/
|
|
|
|
export async function authenticateWizardRequest(): Promise<boolean> {
|
|
const jar = await cookies();
|
|
const token = jar.get(SETUP_COOKIE)?.value;
|
|
if (!token) return false;
|
|
return verifySetupToken(token);
|
|
}
|
|
|
|
export function buildSessionCookieAttributes(request?: NextRequest) {
|
|
// Match Secure to the actual request protocol. Browsers drop Secure cookies
|
|
// on plain HTTP, so unconditionally setting Secure in production breaks
|
|
// setup over HTTP — the operator gets "Wizard session required" on every
|
|
// step. The wizard surfaces a cleartext-credentials warning in the UI when
|
|
// HTTPS isn't in use.
|
|
return {
|
|
name: SETUP_COOKIE,
|
|
httpOnly: true,
|
|
sameSite: 'lax' as const,
|
|
secure: request ? isHttpsRequest(request) : process.env.NODE_ENV === 'production',
|
|
path: '/',
|
|
maxAge: COOKIE_MAX_AGE,
|
|
};
|
|
}
|
|
|
|
function isHttpsRequest(request: NextRequest): boolean {
|
|
const forwarded = request.headers.get('x-forwarded-proto');
|
|
if (forwarded) {
|
|
return forwarded.split(',')[0]!.trim().toLowerCase() === 'https';
|
|
}
|
|
return request.nextUrl.protocol === 'https:';
|
|
}
|