autosnippet 3.0.1 → 3.0.2

package/lib/http/routes/auth.js

@@ -9,8 +9,8 @@
  * 使用 HMAC-SHA256 签发简单 JWT-like token（无第三方依赖）。
  */
 
-import express from 'express';
 import crypto from 'node:crypto';
+import express from 'express';
 import { asyncHandler } from '../middleware/errorHandler.js';
 
 const router = express.Router();
@@ -21,17 +21,18 @@ const router = express.Router();
 
 const AUTH_USERNAME = process.env.ASD_AUTH_USERNAME || 'admin';
 const AUTH_PASSWORD = process.env.ASD_AUTH_PASSWORD || 'autosnippet';
-const TOKEN_SECRET  = process.env.ASD_AUTH_SECRET  || crypto.randomBytes(32).toString('hex');
+const TOKEN_SECRET = process.env.ASD_AUTH_SECRET || crypto.randomBytes(32).toString('hex');
 
 // 安全警告：仅在认证启用且使用默认凭据时提示
-const authEnabled = process.env.VITE_AUTH_ENABLED === 'true' || process.env.ASD_AUTH_ENABLED === 'true';
+const authEnabled =
+  process.env.VITE_AUTH_ENABLED === 'true' || process.env.ASD_AUTH_ENABLED === 'true';
 if (authEnabled && (!process.env.ASD_AUTH_USERNAME || !process.env.ASD_AUTH_PASSWORD)) {
   console.warn(
-    '[auth] WARNING: Using default credentials (admin/autosnippet). '
-    + 'Set ASD_AUTH_USERNAME and ASD_AUTH_PASSWORD environment variables for production.',
+    '[auth] WARNING: Using default credentials (admin/autosnippet). ' +
+      'Set ASD_AUTH_USERNAME and ASD_AUTH_PASSWORD environment variables for production.'
   );
 }
-const TOKEN_TTL     = 7 * 24 * 60 * 60 * 1000; // 7 天
+const TOKEN_TTL = 7 * 24 * 60 * 60 * 1000; // 7 天
 
 // 将 secret 写回环境变量，供 roleResolver 等模块共享
 if (!process.env.ASD_AUTH_SECRET) {
@@ -55,16 +56,27 @@ function createToken(username) {
 }
 
 function verifyToken(token) {
-  if (!token || typeof token !== 'string') return null;
+  if (!token || typeof token !== 'string') {
+    return null;
+  }
   const [payloadB64, sig] = token.split('.');
-  if (!payloadB64 || !sig) return null;
+  if (!payloadB64 || !sig) {
+    return null;
+  }
 
-  const expectedSig = crypto.createHmac('sha256', TOKEN_SECRET).update(payloadB64).digest('base64url');
-  if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expectedSig))) return null;
+  const expectedSig = crypto
+    .createHmac('sha256', TOKEN_SECRET)
+    .update(payloadB64)
+    .digest('base64url');
+  if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expectedSig))) {
+    return null;
+  }
 
   try {
     const payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString());
-    if (payload.exp && payload.exp < Date.now()) return null; // 已过期
+    if (payload.exp && payload.exp < Date.now()) {
+      return null; // 已过期
+    }
     return payload;
   } catch {
     return null;
@@ -79,63 +91,71 @@ function verifyToken(token) {
  * POST /auth/login
  * Body: { username, password }
  */
-router.post('/login', asyncHandler(async (req, res) => {
-  const { username, password } = req.body || {};
-
-  if (!username || !password) {
-    return res.status(400).json({
-      success: false,
-      error: { code: 'VALIDATION_ERROR', message: '用户名和密码不能为空' },
+router.post(
+  '/login',
+  asyncHandler(async (req, res) => {
+    const { username, password } = req.body || {};
+
+    if (!username || !password) {
+      return res.status(400).json({
+        success: false,
+        error: { code: 'VALIDATION_ERROR', message: '用户名和密码不能为空' },
+      });
+    }
+
+    // 恒时比较防止时序攻击
+    const userOk =
+      username.length === AUTH_USERNAME.length &&
+      crypto.timingSafeEqual(Buffer.from(username), Buffer.from(AUTH_USERNAME));
+    const passOk =
+      password.length === AUTH_PASSWORD.length &&
+      crypto.timingSafeEqual(Buffer.from(password), Buffer.from(AUTH_PASSWORD));
+
+    if (!userOk || !passOk) {
+      return res.status(401).json({
+        success: false,
+        error: { code: 'UNAUTHORIZED', message: '用户名或密码错误' },
+      });
+    }
+
+    const token = createToken(username);
+
+    return res.json({
+      success: true,
+      data: {
+        token,
+        user: { username, role: 'developer' },
+      },
     });
-  }
-
-  // 恒时比较防止时序攻击
-  const userOk = username.length === AUTH_USERNAME.length &&
-    crypto.timingSafeEqual(Buffer.from(username), Buffer.from(AUTH_USERNAME));
-  const passOk = password.length === AUTH_PASSWORD.length &&
-    crypto.timingSafeEqual(Buffer.from(password), Buffer.from(AUTH_PASSWORD));
-
-  if (!userOk || !passOk) {
-    return res.status(401).json({
-      success: false,
-      error: { code: 'UNAUTHORIZED', message: '用户名或密码错误' },
-    });
-  }
-
-  const token = createToken(username);
-
-  return res.json({
-    success: true,
-    data: {
-      token,
-      user: { username, role: 'developer' },
-    },
-  });
-}));
+  })
+);
 
 /**
  * GET /auth/me
  * Header: Authorization: Bearer <token>
  */
-router.get('/me', asyncHandler(async (req, res) => {
-  const authHeader = req.headers.authorization || '';
-  const token = authHeader.startsWith('Bearer ') ? authHeader.slice(7) : '';
-  const payload = verifyToken(token);
-
-  if (!payload) {
-    return res.status(401).json({
-      success: false,
-      error: { code: 'UNAUTHORIZED', message: 'Token 无效或已过期' },
+router.get(
+  '/me',
+  asyncHandler(async (req, res) => {
+    const authHeader = req.headers.authorization || '';
+    const token = authHeader.startsWith('Bearer ') ? authHeader.slice(7) : '';
+    const payload = verifyToken(token);
+
+    if (!payload) {
+      return res.status(401).json({
+        success: false,
+        error: { code: 'UNAUTHORIZED', message: 'Token 无效或已过期' },
+      });
+    }
+
+    return res.json({
+      success: true,
+      data: {
+        user: { username: payload.sub, role: payload.role },
+      },
     });
-  }
-
-  return res.json({
-    success: true,
-    data: {
-      user: { username: payload.sub, role: payload.role },
-    },
-  });
-}));
+  })
+);
 
 export { verifyToken };
 export default router;