import { makeAuthToken, parseAuthToken } from "./security";
export const AUTH_COOKIE = "fh_auth";
export const AUTH_TTL_MS = 30 * 60 * 1000;
export function parseCookie(header: string | null, name: string): string | null {
if (!header) return null;
for (const part of header.split(";")) {
const idx = part.indexOf("=");
if (idx === -1) continue;
if (part.slice(0, idx).trim() === name) return part.slice(idx + 1).trim();
}
return null;
}
export function hasValidAuth(req: Request, secret: string, key: string): boolean {
const token = parseCookie(req.headers.get("cookie"), AUTH_COOKIE);
if (!token) return false;
const parsed = parseAuthToken(token, secret);
return parsed !== null && parsed.key === key;
}
export function authCookieValue(key: string, secret: string): string {
const token = makeAuthToken(key, secret, AUTH_TTL_MS);
return `${AUTH_COOKIE}=${token}`;
}
function escapeHtml(value: string): string {
return value
.replace(/&/g, "&")
.replace(//g, ">")
.replace(/"/g, """)
.replace(/'/g, "'");
}
export function renderPasswordForm(
key: string,
filename: string,
error: boolean,
): Response {
const message = error
? 'Incorrect password. Please try again.
'
: "";
const html = `
Protected file
Protected file
Enter the password to download ${escapeHtml(filename)}.
${message}
`;
return new Response(html, {
status: 200,
headers: {
"content-type": "text/html; charset=utf-8",
"cache-control": "private, no-store",
"x-content-type-options": "nosniff",
"referrer-policy": "no-referrer",
"content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'",
},
});
}