security

src/server.ts

@@ -3,6 +3,7 @@ import { loadConfig } from "./config";
 import { json, jsonError, notFound, securityHeaders } from "./http";
 import { log } from "./log";
 import { RateLimiter } from "./ratelimit";
+import { handleAuth } from "./routes/auth";
 import { handleDelete } from "./routes/delete";
 import { handleDownload } from "./routes/download";
 import { handleUpload } from "./routes/upload";
@@ -12,6 +13,7 @@ const cfg = loadConfig();
 
 const storage = new Storage(cfg.storageDir);
 await storage.init();
+const secret = await storage.loadSecret();
 const sweep = await storage.sweep();
 if (sweep.removedFiles > 0 || sweep.removedMetadata > 0) {
   log(
@@ -77,6 +79,11 @@ function serveStatic(path: string): Response {
   });
 }
 
+function isSecure(req: Request, url: URL): boolean {
+  if (cfg.trustProxy) return req.headers.get("x-forwarded-proto") === "https";
+  return url.protocol === "https:";
+}
+
 async function route(req: Request, srv: Server<undefined>): Promise<Response> {
   const url = new URL(req.url);
   const path = url.pathname;
@@ -92,11 +99,18 @@ async function route(req: Request, srv: Server<undefined>): Promise<Response> {
     return handleUpload(req, storage, cfg.maxFileSize);
   }
 
+  if (path.startsWith("/api/auth/") && method === "POST") {
+    if (cfg.rateLimitEnabled && !limiter.check(clientIp(req, srv))) {
+      return jsonError(429, "too many requests");
+    }
+    return handleAuth(req, storage, path.slice("/api/auth/".length), secret, isSecure(req, url));
+  }
+
   if (path.startsWith("/d/") && (method === "GET" || method === "HEAD")) {
     if (cfg.rateLimitEnabled && !limiter.check(clientIp(req, srv))) {
       return jsonError(429, "too many requests");
     }
-    return handleDownload(req, storage, path.slice(3));
+    return handleDownload(req, storage, path.slice(3), secret);
   }
 
   if (path.startsWith("/api/files/") && method === "DELETE") {