chore: sync local changes to Gitea

src/lib/auth.ts

@@ -0,0 +1,78 @@
+import { cleanText } from "./text";
+import { getAdminPassword, unauthorized } from "./http";
+
+export function parseCookie(header: string): Record<string, string> {
+  const out: Record<string, string> = {};
+  if (!header) return out;
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1) continue;
+    const k = part.slice(0, idx).trim();
+    const v = part.slice(idx + 1).trim();
+    try {
+      out[k] = decodeURIComponent(v);
+    } catch {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+
+export async function adminSessionCookieValue(env: Env): Promise<string> {
+  const password = getAdminPassword(env);
+  const enc = new TextEncoder();
+  const data = enc.encode(`${password}\0sproutblog_admin_v1`);
+  const hash = await crypto.subtle.digest("SHA-256", data);
+  return [...new Uint8Array(hash)]
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
+}
+
+/**
+ * 需要后台权限的接口：未配置密码则放行；否则校验 Cookie 或 Basic Auth。
+ * 返回 null 表示已通过；返回 Response 为 401。
+ */
+export async function requireAdmin(
+  request: Request,
+  env: Env
+): Promise<Response | null> {
+  const password = getAdminPassword(env);
+  if (!password) return null;
+
+  const cookies = parseCookie(request.headers.get("Cookie") || "");
+  const expected = await adminSessionCookieValue(env);
+  if (cookies.sb_admin && cookies.sb_admin === expected) {
+    return null;
+  }
+
+  const header = request.headers.get("Authorization") || "";
+  if (header.startsWith("Basic ")) {
+    try {
+      const decoded = atob(header.slice(6));
+      const split = decoded.indexOf(":");
+      const inputPassword = split >= 0 ? decoded.slice(split + 1) : "";
+      if (inputPassword === password) return null;
+    } catch {
+      /* ignore */
+    }
+  }
+
+  return unauthorized();
+}
+
+/** 已配置密码且当前请求具备后台凭证（Cookie / Basic） */
+export async function hasValidAdminSession(
+  request: Request,
+  env: Env
+): Promise<boolean> {
+  const password = getAdminPassword(env);
+  if (!password) return false;
+  return (await requireAdmin(request, env)) === null;
+}
+
+/** 是否可列出/阅读草稿（未配置密码时保持原先「全量可见」行为） */
+export async function canAccessDrafts(request: Request, env: Env): Promise<boolean> {
+  const password = getAdminPassword(env);
+  if (!password) return true;
+  return (await requireAdmin(request, env)) === null;
+}