`routes/auth.js`

43 lines
const express = require('express');
const router = express.Router();

// Login endpoint
router.post('/login', (req, res) => {
  const { username, password } = req.body;

  const validUsername = process.env.ADMIN_USER || 'admin';
  const validPassword = process.env.ADMIN_PASS || '2025';

  // Sanitize inputs
  if (!username || !password || typeof username !== 'string' || typeof password !== 'string') {
    return res.status(400).json({
      success: false,
      error: 'Invalid credentials format'
    });
  }

  if (username === validUsername && password === validPassword) {
    req.session.authenticated = true;
    req.session.username = username;

    return res.json({
      success: true,
      message: 'Authentication successful'
    });
  } else {
    return res.status(401).json({
      success: false,
      error: 'Invalid username or password'
    });
  }
});

// Check authentication status
router.get('/status', (req, res) => {
  res.json({
    authenticated: !!req.session.authenticated
  });
});

module.exports = router;