@merijnslegers/admin 0.1.0 → 0.2.0

package/README.md

@@ -52,7 +52,12 @@ export const admin = createAdmin({
 	serviceRoleKey: SUPABASE_SERVICE_ROLE_KEY,
 	allowList: ADMIN_EMAILS,
 	// Optional: a project in Dutch names its screens in Dutch.
-	paths: { login: '/admin/inloggen', password: '/admin/wachtwoord' }
+	paths: { login: '/admin/inloggen', password: '/admin/wachtwoord' },
+	// Optional: the hook's 401 and 403 in the project's own words.
+	responses: {
+		unauthorized: 'U bent niet ingelogd.',
+		forbidden: 'Dit verzoek kwam niet van onze eigen site.'
+	}
 });
 ```
 
@@ -74,6 +79,8 @@ For everything under the admin path it:
 - answers a request that can change something with a 403 when it does not come
   from the site's own origin, even when SvelteKit's own check is off for a
   webhook;
+- gives that 401 or 403 the text from `responses` as plain text, or an empty
+  body without it, so the package chooses no words of its own;
 - puts `ADMIN_HEADERS` on every response: no framing, `noindex`, `no-store`,
   a referrer that stays on the site.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@merijnslegers/admin",
-	"version": "0.1.0",
+	"version": "0.2.0",
 	"description": "The admin login of the software factory: Supabase Auth with an allow list, the access rules and headers, and image resizing in the browser.",
 	"license": "MIT",
 	"type": "module",

package/src/rules.d.ts

@@ -13,6 +13,12 @@ export type AdminDecision =
 	| { kind: 'unauthorized' }
 	| { kind: 'forbidden' };
 
+/** The project's own words for the hook's 401 and 403. A missing one is an empty body. */
+export interface AdminResponses {
+	unauthorized?: string;
+	forbidden?: string;
+}
+
 export interface SettingNames {
 	supabaseUrl: string;
 	anonKey: string;
@@ -45,6 +51,7 @@ export function adminDecision(request: {
 	signedIn: boolean;
 	paths: AdminPaths;
 }): AdminDecision;
+export function refusal(kind: 'unauthorized' | 'forbidden', responses?: AdminResponses): Response;
 export function missingSettings(
 	settings: {
 		supabaseUrl: string;

package/src/rules.js

@@ -153,6 +153,20 @@ export function adminDecision({ url, method, contentType, origin, signedIn, path
 	return { kind: 'unauthorized' };
 }
 
+/**
+ * The answer to an `unauthorized` (401) or `forbidden` (403) decision. The
+ * package chooses no words (F-0011): the body is the project's own text from
+ * `responses`, or empty when it passes none. `ADMIN_HEADERS` are on it too.
+ */
+export function refusal(kind, responses = {}) {
+	const status = kind === 'forbidden' ? 403 : 401;
+	const text = (kind === 'forbidden' ? responses.forbidden : responses.unauthorized) ?? '';
+	const headers = new Headers(ADMIN_HEADERS);
+	if (!text) return new Response(null, { status, headers });
+	headers.set('Content-Type', 'text/plain; charset=utf-8');
+	return new Response(text, { status, headers });
+}
+
 /**
  * The settings logging in needs that are missing, by the names the project
  * gave them. Empty when everything is there. Without them nobody gets in

package/src/server.d.ts

@@ -1,6 +1,6 @@
 import type { Cookies } from '@sveltejs/kit';
 import type { Handle } from '@sveltejs/kit/hooks';
-import type { AdminPaths, SettingNames } from './rules.js';
+import type { AdminPaths, AdminResponses, SettingNames } from './rules.js';
 
 export interface AdminOptions {
 	/** Read at runtime in the project's src/env.ts (F-0005). An empty string means missing. */
@@ -13,6 +13,8 @@ export interface AdminOptions {
 	paths?: Partial<AdminPaths>;
 	/** The names `missingSettings()` reports, if the project's variables are named differently. */
 	settingNames?: Partial<SettingNames>;
+	/** The body of the hook's 401 and 403, in the project's own words. Without it the body is empty. */
+	responses?: AdminResponses;
 }
 
 export interface Admin {

package/src/server.js

@@ -24,6 +24,7 @@ import {
 	parseAllowList,
 	passwordOutcome,
 	passwordProblem,
+	refusal,
 	signInOutcome
 } from './rules.js';
 
@@ -106,9 +107,7 @@ export function createAdmin(options) {
 		const response =
 			decision.kind === 'pass'
 				? await resolve(event)
-				: new Response(decision.kind === 'forbidden' ? 'Forbidden' : 'Unauthorized', {
-						status: decision.kind === 'forbidden' ? 403 : 401
-					});
+				: refusal(decision.kind, options.responses);
 		for (const [name, value] of Object.entries(ADMIN_HEADERS)) response.headers.set(name, value);
 		return response;
 	}