DorianandClaude Opus 4.6
cc7d9fc19e
Generate random VITE_DEV_API_TOKEN in dev.sh, validate Bearer token in shared server/dev-auth.ts middleware. Applied to all Vite plugins (fs, dev-chats, rss, web-search, tmdb, music-search) and claude-proxy. Client-side uses apiFetch() wrapper to attach the token automatically. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
19 lines
786 B
TypeScript
19 lines
786 B
TypeScript
/**
|
|
* Shared dev server authentication middleware.
|
|
* Validates Bearer token on all /api/* requests.
|
|
* Token is auto-generated in scripts/dev.sh and injected via VITE_DEV_API_TOKEN.
|
|
*/
|
|
import type { IncomingMessage, ServerResponse } from 'http'
|
|
|
|
const DEV_TOKEN = process.env.VITE_DEV_API_TOKEN ?? ''
|
|
|
|
/** Validate Authorization header. Returns true if authorized, false if rejected (response already sent). */
|
|
export function validateDevAuth(req: IncomingMessage, res: ServerResponse): boolean {
|
|
if (!DEV_TOKEN) return true // No token configured, skip auth
|
|
const auth = req.headers.authorization
|
|
if (auth === `Bearer ${DEV_TOKEN}`) return true
|
|
res.writeHead(401, { 'Content-Type': 'application/json' })
|
|
res.end(JSON.stringify({ error: 'Unauthorized' }))
|
|
return false
|
|
}
|