39 lines
1.1 KiB
JavaScript
39 lines
1.1 KiB
JavaScript
import {
|
|
createAdminSessionCookie,
|
|
hasTrustedSameOrigin,
|
|
issueAdminSession,
|
|
setAdminAuthNoStore,
|
|
validateAdminPassphrase
|
|
} from "../../../../lib/admin/adminAuth";
|
|
import { respondError, respondSuccess } from "../../middleware/apiResponse";
|
|
|
|
const forbidden = (res) =>
|
|
respondError(res, {
|
|
status: 403,
|
|
code: "FORBIDDEN",
|
|
message: "Request not permitted"
|
|
});
|
|
|
|
export default async function handler(req, res) {
|
|
setAdminAuthNoStore(res);
|
|
res.setHeader("Allow", "POST");
|
|
|
|
if (req.method !== "POST") {
|
|
return respondError(res, {
|
|
status: 405,
|
|
code: "METHOD_NOT_ALLOWED",
|
|
message: "Method not allowed"
|
|
});
|
|
}
|
|
|
|
if (!hasTrustedSameOrigin(req)) return forbidden(res);
|
|
|
|
const passphrase = req.body?.passphrase;
|
|
if (!validateAdminPassphrase(passphrase)) return forbidden(res);
|
|
|
|
const token = issueAdminSession();
|
|
if (!token) return forbidden(res);
|
|
|
|
res.setHeader("Set-Cookie", createAdminSessionCookie(token));
|
|
return respondSuccess(res, { authenticated: true });
|
|
} |