Protect Tabularium with persistent authenticator-code login

apps/docs/src/proxy.ts

@@ -0,0 +1,65 @@
+import { NextResponse, type NextRequest } from "next/server";
+import { authConfig, SESSION_COOKIE, validSession } from "./lib/auth";
+
+export function proxy(request: NextRequest) {
+  const path = request.nextUrl.pathname;
+  const headers = {
+    "Cache-Control": "private, no-store",
+    "Referrer-Policy": "same-origin",
+  };
+  if (
+    path === "/login" ||
+    path === "/api/health" ||
+    path === "/api/auth/login" ||
+    path === "/api/auth/logout" ||
+    path.startsWith("/_next/static/")
+  ) {
+    return NextResponse.next({ headers });
+  }
+  let config;
+  try {
+    config = authConfig();
+  } catch {
+    /* Missing or invalid files fail closed. */
+  }
+  if (!config)
+    return NextResponse.json(
+      { error: "登录服务尚未配置，请联系管理员" },
+      { status: 503, headers },
+    );
+  const authorization = request.headers.get("authorization");
+  const bearer = authorization?.startsWith("Bearer ")
+    ? authorization.slice(7)
+    : undefined;
+  const token = bearer ?? request.cookies.get(SESSION_COOKIE)?.value;
+  if (validSession(token, config)) {
+    if (!["GET", "HEAD", "OPTIONS"].includes(request.method) && !bearer) {
+      try {
+        if (
+          !request.headers.get("origin") ||
+          new URL(request.headers.get("origin")!).host !==
+            request.headers.get("host") ||
+          request.headers.get("sec-fetch-site") === "cross-site"
+        )
+          throw new Error();
+      } catch {
+        return NextResponse.json(
+          { error: "请求来源不受信任" },
+          { status: 403, headers },
+        );
+      }
+    }
+    return NextResponse.next({ headers });
+  }
+  if (path.startsWith("/api/") || !["GET", "HEAD"].includes(request.method)) {
+    return NextResponse.json(
+      { error: "请先使用动态码登录" },
+      { status: 401, headers },
+    );
+  }
+  const login = request.nextUrl.clone();
+  login.pathname = "/login";
+  login.search = "";
+  login.searchParams.set("next", path + request.nextUrl.search);
+  return NextResponse.redirect(login, { headers });
+}