security

src/routes/download.ts

@@ -1,4 +1,5 @@
 import { lstat } from "node:fs/promises";
+import { hasValidAuth, renderPasswordForm } from "../auth";
 import { notFound } from "../http";
 import { log } from "../log";
 import { contentDisposition, fileIdFromKey, KEY_PATTERN, secretMatches } from "../security";
@@ -8,6 +9,7 @@ export async function handleDownload(
   req: Request,
   storage: Storage,
   rawKey: string,
+  secret: string,
 ): Promise<Response> {
   if (!KEY_PATTERN.test(rawKey)) return notFound();
   const id = fileIdFromKey(rawKey);
@@ -17,6 +19,11 @@ export async function handleDownload(
   if (!meta) return notFound();
   if (!secretMatches(meta.downloadKeyHash, rawKey)) return notFound();
 
+  if (meta.passwordHash && !hasValidAuth(req, secret, rawKey)) {
+    const url = new URL(req.url);
+    return renderPasswordForm(rawKey, meta.originalName, url.searchParams.has("e"));
+  }
+
   const filePath = storage.filePath(id);
   let fileStat;
   try {