a066300cf2
- POST /api/auth/login: HMAC-SHA256 signed 7-day token, password from DASHBOARD_PASSWORD env - GET /api/auth/verify: stateless token validation - requireAuth middleware applied to all /api/* routes (except /api/health + /api/auth) - /dashboard/login.html: dark TIP-themed login page with show/hide password toggle - index.html: auth guard redirect to login + Authorization header on all api() calls - No secrets in code — password stored in .env only
17 lines
556 B
TypeScript
17 lines
556 B
TypeScript
/**
|
|
* requireAuth middleware — validates Bearer token on protected routes.
|
|
* Skip for: /api/auth/login, /api/health
|
|
*/
|
|
import { Request, Response, NextFunction } from "express";
|
|
import { verifyToken } from "../routes/auth";
|
|
|
|
export function requireAuth(req: Request, res: Response, next: NextFunction): void {
|
|
const auth = req.headers.authorization ?? "";
|
|
const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
|
|
if (verifyToken(token)) {
|
|
next();
|
|
} else {
|
|
res.status(401).json({ error: "Unauthorized — please log in" });
|
|
}
|
|
}
|