Kevin L'Hereec
991173aa05
- Add session-based authentication for web-UI (Login.vue, AuthController) - Add AuthSessionMiddleware: redirects unauthenticated users to /login - Add ApiKeyMiddleware: validates X-Api-Key header on all /api/v1 routes - Add BasicAuthMiddleware: registered for future M2M use - Use timingSafeEqual for all credential comparisons (timing attack prevention) - Regenerate session ID on login (session fixation prevention) - Validate redirect target after login (open redirect prevention) - Require WEBUI_USERNAME, WEBUI_PASSWORD, API_KEY as mandatory env vars - Share auth.username/authenticated via Inertia shared props - Add user dropdown in navbar (avatar icon + username + logout) - Add login i18n keys in fr.json and en.json - Remove orphan SQL migrations (users, auth_access_tokens) and @adonisjs/lucid
30 lines
1.2 KiB
TypeScript
30 lines
1.2 KiB
TypeScript
import router from '@adonisjs/core/services/router'
|
|
import server from '@adonisjs/core/services/server'
|
|
|
|
server.errorHandler(() => import('#exceptions/handler'))
|
|
|
|
server.use([
|
|
() => import('#middleware/container_bindings_middleware'),
|
|
() => import('@adonisjs/static/static_middleware'),
|
|
() => import('@adonisjs/cors/cors_middleware'),
|
|
() => import('@adonisjs/vite/vite_middleware'),
|
|
])
|
|
|
|
router.use([
|
|
() => import('@adonisjs/core/bodyparser_middleware'),
|
|
() => import('@adonisjs/session/session_middleware'),
|
|
() => import('@adonisjs/shield/shield_middleware'),
|
|
() => import('#middleware/inertia_middleware'),
|
|
])
|
|
|
|
export const middleware = router.named({
|
|
cwmpLogger: () => import('#middleware/cwmp_logger_middleware'),
|
|
cwmp: () => import('#middleware/cwmp_middleware'),
|
|
// basicAuth: available for machine-to-machine Basic Auth access if needed in the future
|
|
basicAuth: () => import('#middleware/basic_auth_middleware'),
|
|
// apiKey: protects all /api/v1 routes (X-Api-Key header)
|
|
apiKey: () => import('#middleware/api_key_middleware'),
|
|
// authSession: protects all web-ui routes (session-based login page)
|
|
authSession: () => import('#middleware/auth_session_middleware'),
|
|
})
|