Adding temporarty keycard escape
This commit is contained in:
Vendored
+140
-1
@@ -17,6 +17,7 @@ export function labAuthConfig() {
|
||||
keycardMeritSlug: process.env.LAB_KEYCARD_MERIT_SLUG ?? 'lab-keycard',
|
||||
keycardRequired: envFlag('LAB_KEYCARD_REQUIRED', true),
|
||||
signInUrl: process.env.LAB_SIGN_IN_URL ?? `${gnommowebUrl}/auth/google`,
|
||||
temporarySecretKey: process.env.LAB_TEMP_SECRET_KEY ?? 'supersecret',
|
||||
userProfileUrl: process.env.LAB_USER_PROFILE_URL ?? `${gnommowebUrl}/api/user/profile`
|
||||
};
|
||||
}
|
||||
@@ -38,6 +39,112 @@ function loginUrl(request, config) {
|
||||
url.searchParams.set('returnTo', returnTo);
|
||||
return url.toString();
|
||||
}
|
||||
function temporaryCookieOptions(request) {
|
||||
const secure = request.secure || request.get('x-forwarded-proto') === 'https';
|
||||
return {
|
||||
httpOnly: true,
|
||||
maxAge: 1000 * 60 * 60 * 12,
|
||||
sameSite: 'lax',
|
||||
secure
|
||||
};
|
||||
}
|
||||
function hasTemporaryAccess(request, config) {
|
||||
return Boolean(config.temporarySecretKey && request.cookies?.lab_temp_key === config.temporarySecretKey);
|
||||
}
|
||||
function isLocalLoginPath(request) {
|
||||
return request.path === '/lab-login' || request.path === '/admin/lab-login';
|
||||
}
|
||||
function localLoginPage(config, error = '') {
|
||||
return `<!doctype html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>CA Lab Login</title>
|
||||
<style>
|
||||
body {
|
||||
margin: 0;
|
||||
min-height: 100vh;
|
||||
display: grid;
|
||||
place-items: center;
|
||||
background: #008080;
|
||||
color: #000;
|
||||
font-family: "MS Sans Serif", Tahoma, Arial, sans-serif;
|
||||
}
|
||||
main {
|
||||
width: min(560px, calc(100vw - 32px));
|
||||
border: 2px solid;
|
||||
border-color: #fff #404040 #404040 #fff;
|
||||
background: #c0c0c0;
|
||||
box-shadow: 4px 4px 0 rgb(0 0 0 / 0.35);
|
||||
}
|
||||
header {
|
||||
padding: 6px 8px;
|
||||
background: linear-gradient(90deg, #000080, #1084d0);
|
||||
color: #fff;
|
||||
font-weight: 700;
|
||||
}
|
||||
section { padding: 18px; }
|
||||
h1 { margin: 0 0 10px; font-size: 1.2rem; }
|
||||
p { line-height: 1.45; }
|
||||
label { display: block; margin-top: 12px; font-weight: 700; }
|
||||
input {
|
||||
width: 100%;
|
||||
min-height: 34px;
|
||||
margin-top: 6px;
|
||||
border: 2px solid;
|
||||
border-color: #404040 #fff #fff #404040;
|
||||
background: #fff;
|
||||
color: #000;
|
||||
padding: 6px 8px;
|
||||
box-sizing: border-box;
|
||||
font: inherit;
|
||||
}
|
||||
button, a {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
min-height: 34px;
|
||||
margin-top: 14px;
|
||||
padding: 0 14px;
|
||||
border: 2px solid;
|
||||
border-color: #fff #404040 #404040 #fff;
|
||||
background: #c0c0c0;
|
||||
color: #000;
|
||||
text-decoration: none;
|
||||
font: inherit;
|
||||
cursor: pointer;
|
||||
}
|
||||
.error { color: #800000; font-weight: 700; }
|
||||
.actions { display: flex; flex-wrap: wrap; gap: 10px; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<main>
|
||||
<header>CA Lab Computer</header>
|
||||
<section>
|
||||
<h1>Insert lab keycard</h1>
|
||||
<p>Sign in with your Glitch University JWT, or use the temporary lab key while access is being repaired.</p>
|
||||
${error ? `<p class="error">${escapeHtml(error)}</p>` : ''}
|
||||
<form method="post" action="/admin/lab-login">
|
||||
<label>
|
||||
JWT token
|
||||
<input name="jwt_token" autocomplete="off" spellcheck="false">
|
||||
</label>
|
||||
<label>
|
||||
Temporary secret key
|
||||
<input name="secret_key" type="password" autocomplete="current-password">
|
||||
</label>
|
||||
<div class="actions">
|
||||
<button type="submit">Unlock lab</button>
|
||||
<a href="${escapeHtml(config.signInUrl)}">Glitch University sign in</a>
|
||||
</div>
|
||||
</form>
|
||||
</section>
|
||||
</main>
|
||||
</body>
|
||||
</html>`;
|
||||
}
|
||||
function lockedPage(access, config) {
|
||||
const unlockUrl = access.unlockUrl ?? `${config.gnommowebUrl}/tech-tree`;
|
||||
const reason = access.reason ?? 'Your Glitch University account does not have the CA Lab Keycard yet.';
|
||||
@@ -95,6 +202,13 @@ function lockedPage(access, config) {
|
||||
<p>${escapeHtml(reason)}</p>
|
||||
<p>Earn the Cellular Automata lab merit on glitch.university, then return here.</p>
|
||||
<a href="${escapeHtml(unlockUrl)}">Go to Glitch University</a>
|
||||
<form method="post" action="/admin/lab-login">
|
||||
<label>
|
||||
Temporary secret key
|
||||
<input name="secret_key" type="password" autocomplete="current-password">
|
||||
</label>
|
||||
<button type="submit">Unlock temporarily</button>
|
||||
</form>
|
||||
</section>
|
||||
</main>
|
||||
</body>
|
||||
@@ -171,6 +285,31 @@ export function requireLabAccess(config = labAuthConfig()) {
|
||||
next();
|
||||
return;
|
||||
}
|
||||
if (request.method === 'GET' && isLocalLoginPath(request)) {
|
||||
response.type('html').send(localLoginPage(config));
|
||||
return;
|
||||
}
|
||||
if (request.method === 'POST' && isLocalLoginPath(request)) {
|
||||
const jwtToken = typeof request.body?.jwt_token === 'string' ? request.body.jwt_token.trim() : '';
|
||||
const secretKey = typeof request.body?.secret_key === 'string' ? request.body.secret_key.trim() : '';
|
||||
if (config.temporarySecretKey && secretKey === config.temporarySecretKey) {
|
||||
response.cookie('lab_temp_key', config.temporarySecretKey, temporaryCookieOptions(request));
|
||||
response.redirect('/admin');
|
||||
return;
|
||||
}
|
||||
if (jwtToken) {
|
||||
response.cookie('auth_token', jwtToken, temporaryCookieOptions(request));
|
||||
response.redirect('/admin');
|
||||
return;
|
||||
}
|
||||
response.status(401).type('html').send(localLoginPage(config, 'Enter a JWT token or the temporary secret key.'));
|
||||
return;
|
||||
}
|
||||
if (hasTemporaryAccess(request, config)) {
|
||||
request.labAccess = { allowed: true, reason: 'Temporary CA Lab secret key accepted.' };
|
||||
next();
|
||||
return;
|
||||
}
|
||||
if (!config.jwtSecret) {
|
||||
response.status(500).json({ error: 'Lab authentication is enabled but JWT_SECRET is not configured' });
|
||||
return;
|
||||
@@ -178,7 +317,7 @@ export function requireLabAccess(config = labAuthConfig()) {
|
||||
const token = request.cookies?.auth_token;
|
||||
if (!token) {
|
||||
if (wantsHtml(request)) {
|
||||
response.redirect(loginUrl(request, config));
|
||||
response.status(401).type('html').send(localLoginPage(config));
|
||||
return;
|
||||
}
|
||||
response.status(401).json({
|
||||
|
||||
Reference in New Issue
Block a user