Kevin L'Hereec
991173aa05
- Add session-based authentication for web-UI (Login.vue, AuthController) - Add AuthSessionMiddleware: redirects unauthenticated users to /login - Add ApiKeyMiddleware: validates X-Api-Key header on all /api/v1 routes - Add BasicAuthMiddleware: registered for future M2M use - Use timingSafeEqual for all credential comparisons (timing attack prevention) - Regenerate session ID on login (session fixation prevention) - Validate redirect target after login (open redirect prevention) - Require WEBUI_USERNAME, WEBUI_PASSWORD, API_KEY as mandatory env vars - Share auth.username/authenticated via Inertia shared props - Add user dropdown in navbar (avatar icon + username + logout) - Add login i18n keys in fr.json and en.json - Remove orphan SQL migrations (users, auth_access_tokens) and @adonisjs/lucid
26 lines
788 B
TypeScript
26 lines
788 B
TypeScript
import type { HttpContext } from '@adonisjs/core/http'
|
|
import type { NextFn } from '@adonisjs/core/types/http'
|
|
|
|
/**
|
|
* AuthSessionMiddleware
|
|
*
|
|
* Protects web-ui routes by requiring an authenticated session.
|
|
* If the session is not authenticated, stores the requested URL
|
|
* in the session and redirects to /login.
|
|
*
|
|
* Login is handled by AuthController + session-based authentication.
|
|
*/
|
|
export default class AuthSessionMiddleware {
|
|
async handle({ session, request, response }: HttpContext, next: NextFn) {
|
|
if (!session.get('authenticated')) {
|
|
// Remember where the user wanted to go
|
|
if (request.method() === 'GET') {
|
|
session.put('redirectAfterLogin', request.url())
|
|
}
|
|
return response.redirect().toPath('/login')
|
|
}
|
|
|
|
return next()
|
|
}
|
|
}
|