@aopslabs/aops-server 0.2.0

package/build/server/chunks/hooks.server-DYGrWbgh.js

@@ -0,0 +1,62 @@
+import { j as json } from './index.js-BQnOaW3H.js';
+import { g as getAuthProvider } from './auth-provider-C07OUlnz.js';
+
+const TRUSTED_LOCAL_PRINCIPAL = Object.freeze({
+  userId: "00000000-0000-4000-8000-000000000001",
+  fullName: "AOPS Local Operator",
+  roles: ["admin"],
+  permissions: ["*"]
+});
+const TRUSTED_LOCAL_TENANT_ID = "123e4567-e89b-41d4-a000-000000000001";
+function isCommunityLoopbackClientAddress(value) {
+  const address = typeof value === "string" ? value.trim().toLowerCase() : "";
+  if (address === "::1") return true;
+  const ipv4 = address.startsWith("::ffff:") ? address.slice("::ffff:".length) : address;
+  const match = /^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(ipv4);
+  if (!match) return false;
+  return match.slice(1).every((octet) => Number(octet) <= 255);
+}
+function loopbackDenied(pathname) {
+  if (pathname.startsWith("/api") || pathname.endsWith(".json")) {
+    return json(
+      { ok: false, error: "trusted_local_loopback_required" },
+      { status: 403 }
+    );
+  }
+  return new Response("trusted_local_loopback_required", {
+    status: 403,
+    headers: { "content-type": "text/plain; charset=utf-8" }
+  });
+}
+function secureResponse(response) {
+  response.headers.set("x-content-type-options", "nosniff");
+  response.headers.set("referrer-policy", "no-referrer");
+  return response;
+}
+const handle = async ({ event, resolve }) => {
+  let authProvider;
+  try {
+    authProvider = getAuthProvider();
+  } catch {
+    return secureResponse(
+      event.url.pathname === "/api" || event.url.pathname.startsWith("/api/") ? json({ ok: false, error: "auth_provider_invalid" }, { status: 503 }) : new Response("auth_provider_invalid", { status: 503 })
+    );
+  }
+  event.locals.tenantId = TRUSTED_LOCAL_TENANT_ID;
+  event.locals.locale = "en";
+  event.locals.fallbackLocale = "en";
+  event.locals.authProvider = authProvider;
+  let clientAddress = "";
+  try {
+    clientAddress = event.getClientAddress();
+  } catch {
+    return secureResponse(loopbackDenied(event.url.pathname));
+  }
+  if (!isCommunityLoopbackClientAddress(clientAddress)) {
+    return secureResponse(loopbackDenied(event.url.pathname));
+  }
+  event.locals.principal = TRUSTED_LOCAL_PRINCIPAL;
+  return secureResponse(await resolve(event));
+};
+
+export { handle, isCommunityLoopbackClientAddress };