`src/lib/auth.js`

43 lines
const jwt = require('jsonwebtoken');
const cookie = require('cookie');

// Audit 2026-05-04: removed inline literal JWT_SECRET + VALID_PASS.
// Old values are now in source-control history; treat as compromised, rotate.
const JWT_SECRET = process.env.JWT_SECRET;
if (!JWT_SECRET) {
  throw new Error('JWT_SECRET env var required (no fallback for production safety)');
}
const VALID_USER = process.env.AUTH_USERNAME || 'admin';
const VALID_PASS = process.env.AUTH_PASSWORD;
if (!VALID_PASS) {
  throw new Error('AUTH_PASSWORD env var required (no fallback for production safety)');
}

function createToken(username) {
  return jwt.sign({ username, role: 'admin' }, JWT_SECRET, { expiresIn: '7d' });
}

function verifyToken(token) {
  try {
    return jwt.verify(token, JWT_SECRET);
  } catch {
    return null;
  }
}

function getTokenFromRequest(req) {
  const cookies = cookie.parse(req.headers.get?.('cookie') || req.headers?.cookie || '');
  if (cookies.bertha_token) return cookies.bertha_token;
  const auth = req.headers.get?.('authorization') || req.headers?.authorization || '';
  if (auth.startsWith('Bearer ')) return auth.slice(7);
  return null;
}

function authenticateRequest(req) {
  const token = getTokenFromRequest(req);
  if (!token) return null;
  return verifyToken(token);
}

module.exports = { createToken, verifyToken, authenticateRequest, VALID_USER, VALID_PASS, JWT_SECRET };