Kevin L'Hereec
991173aa05
- Add session-based authentication for web-UI (Login.vue, AuthController) - Add AuthSessionMiddleware: redirects unauthenticated users to /login - Add ApiKeyMiddleware: validates X-Api-Key header on all /api/v1 routes - Add BasicAuthMiddleware: registered for future M2M use - Use timingSafeEqual for all credential comparisons (timing attack prevention) - Regenerate session ID on login (session fixation prevention) - Validate redirect target after login (open redirect prevention) - Require WEBUI_USERNAME, WEBUI_PASSWORD, API_KEY as mandatory env vars - Share auth.username/authenticated via Inertia shared props - Add user dropdown in navbar (avatar icon + username + logout) - Add login i18n keys in fr.json and en.json - Remove orphan SQL migrations (users, auth_access_tokens) and @adonisjs/lucid
22 lines
635 B
TypeScript
22 lines
635 B
TypeScript
import BaseInertiaMiddleware from '@adonisjs/inertia/inertia_middleware'
|
|
import type { HttpContext } from '@adonisjs/core/http'
|
|
import type { NextFn } from '@adonisjs/core/types/http'
|
|
|
|
export default class InertiaMiddleware extends BaseInertiaMiddleware {
|
|
async share(ctx: HttpContext) {
|
|
return {
|
|
errors: ctx.session?.flashMessages.get('errors'),
|
|
auth: {
|
|
username: ctx.session?.get('username') ?? null,
|
|
authenticated: ctx.session?.get('authenticated') ?? false,
|
|
},
|
|
}
|
|
}
|
|
|
|
async handle(ctx: HttpContext, next: NextFn) {
|
|
await this.init(ctx)
|
|
await next()
|
|
this.dispose(ctx)
|
|
}
|
|
}
|