78 lines
3.8 KiB
TypeScript
78 lines
3.8 KiB
TypeScript
import type { NextFunction, Request, Response } from 'express'
|
|
import jwt, { type JwtPayload } from 'jsonwebtoken'
|
|
|
|
export type OsintClaims = JwtPayload & { role?: string; isAdmin?: boolean; name?:string; preferred_username?:string }
|
|
|
|
declare global {
|
|
namespace Express {
|
|
interface Request { authClaims?: OsintClaims }
|
|
}
|
|
}
|
|
|
|
export function authenticateJwt(req: Request, _res: Response, next: NextFunction) {
|
|
const authorization = req.headers.authorization
|
|
const token = req.cookies?.auth_token || (authorization?.startsWith('Bearer ') ? authorization.slice(7) : undefined)
|
|
const secret = process.env.JWT_SECRET
|
|
if (token && secret) {
|
|
try {
|
|
const decoded = jwt.verify(token, secret)
|
|
if (typeof decoded !== 'string') req.authClaims = decoded as OsintClaims
|
|
} catch { /* An absent, expired, or invalid cookie is an anonymous session. */ }
|
|
}
|
|
next()
|
|
}
|
|
|
|
export function hasAdminClaim(req: Request) {
|
|
return req.authClaims?.role === 'admin' || req.authClaims?.isAdmin === true
|
|
}
|
|
|
|
/**
|
|
* Identity for a player's game state. Real players arrive with a JWT issued by
|
|
* glitch.university (verified through the key-exchange handoff); until that lands,
|
|
* an absent token resolves to a single fixed development user so the game is
|
|
* playable locally with no identity provider. Only this fallback branch changes
|
|
* when the external handoff is wired — the `user_id` column stays the same.
|
|
*/
|
|
export const DEVELOPMENT_TEST_USER_ID = 'osint-test-player'
|
|
export function resolveUserId(req: Request): string | null {
|
|
const sub = req.authClaims?.sub
|
|
if (typeof sub === 'string' && sub.length > 0) return sub
|
|
// In production an absent token is anonymous (no shared identity); locally it
|
|
// resolves to a single dev user so the game is playable without an issuer.
|
|
return process.env.NODE_ENV === 'production' ? null : DEVELOPMENT_TEST_USER_ID
|
|
}
|
|
|
|
export function resolvePlayerName(req: Request): string {
|
|
const candidate = req.authClaims?.name || req.authClaims?.preferred_username || req.authClaims?.sub
|
|
return typeof candidate === 'string' && candidate.trim() ? candidate.trim().slice(0,300) : 'Player'
|
|
}
|
|
|
|
export function requireAdmin(req: Request, res: Response, next: NextFunction) {
|
|
if (!hasAdminClaim(req)) return res.status(403).json({ error: 'Administrator claim required' })
|
|
next()
|
|
}
|
|
|
|
// Operator-designated admins, by handle. Set ADMIN_HANDLES to a comma-separated list
|
|
// (e.g. `ADMIN_HANDLES=jens,ops`); those users receive an admin token at sign-in, so the
|
|
// /admin route and admin APIs open for them. Changing the list takes effect on next login.
|
|
export function isAdminHandle(handle: string) {
|
|
const handles = (process.env.ADMIN_HANDLES || '').split(',').map(entry => entry.trim().toLowerCase()).filter(Boolean)
|
|
return handles.includes(handle.trim().toLowerCase())
|
|
}
|
|
|
|
// Mint a player token (path A: GUPI is the issuer for now). Verification is
|
|
// issuer-agnostic — a glitch.university token with the same sub verifies identically.
|
|
// A handle listed in ADMIN_HANDLES is promoted to an admin token here at sign-in.
|
|
export function signPlayerToken(user: { id: string; displayName: string; handle: string }) {
|
|
if (!process.env.JWT_SECRET) throw new Error('JWT_SECRET is required')
|
|
const admin = isAdminHandle(user.handle)
|
|
const claims = { sub: user.id, name: user.displayName, preferred_username: user.handle, role: admin ? 'admin' : 'player', ...(admin ? { isAdmin: true } : {}) }
|
|
return jwt.sign(claims, process.env.JWT_SECRET, { expiresIn: '30d' })
|
|
}
|
|
|
|
export function createDevelopmentAdminToken() {
|
|
if (process.env.NODE_ENV === 'production') throw new Error('Development sessions are disabled in production')
|
|
if (!process.env.JWT_SECRET) throw new Error('JWT_SECRET is required')
|
|
return jwt.sign({ sub: 'osint-local-admin', role: 'admin', isAdmin: true }, process.env.JWT_SECRET, { expiresIn: '7d' })
|
|
}
|