From 6198c5805592cbcf87c71224fcc3c445f5561709 Mon Sep 17 00:00:00 2001 From: Falkan Date: Fri, 20 Mar 2026 00:11:07 -0400 Subject: [PATCH] fix: use $env/dynamic/private for SESSION_SECRET and PASSWORD_HASH - login/+server.ts: read env vars via $env/dynamic/private (works in Vite dev) - auth.ts: requireAuth now takes secret as parameter instead of reading process.env - authRequest.ts: new route-level helper that reads SESSION_SECRET from $env/dynamic/private and passes it to requireAuth - All admin routes updated to import authRequest from authRequest.ts --- src/lib/server/auth.ts | 13 ++----------- src/lib/server/authRequest.ts | 12 ++++++++++++ src/routes/admin/+layout.server.ts | 2 +- src/routes/admin/api/auth/login/+server.ts | 5 +++-- src/routes/admin/api/groups/+server.ts | 3 ++- src/routes/admin/api/groups/[id]/+server.ts | 3 ++- src/routes/admin/api/order/+server.ts | 2 +- src/routes/admin/api/units/+server.ts | 3 ++- src/routes/admin/api/units/[id]/+server.ts | 3 ++- 9 files changed, 27 insertions(+), 19 deletions(-) create mode 100644 src/lib/server/authRequest.ts diff --git a/src/lib/server/auth.ts b/src/lib/server/auth.ts index 91ed439..85a5870 100644 --- a/src/lib/server/auth.ts +++ b/src/lib/server/auth.ts @@ -60,11 +60,10 @@ export function verifySession(token: string, secret: string): boolean { } /** - * Checks the hu_session cookie in the request against SESSION_SECRET env var. + * Checks the hu_session cookie in the request against the provided secret. * Returns true if a valid session is present. */ -export function requireAuth(request: Request): boolean { - const secret = process.env.SESSION_SECRET ?? ''; +export function requireAuth(request: Request, secret: string): boolean { if (!secret) return false; const cookieHeader = request.headers.get('cookie') ?? ''; const cookies = parse(cookieHeader); @@ -73,14 +72,6 @@ export function requireAuth(request: Request): boolean { return verifySession(token, secret); } -/** - * Convenience: check auth using SESSION_SECRET from env. - * Avoids repeating requireAuth boilerplate in every route. - */ -export function authRequest(request: Request): boolean { - return requireAuth(request); -} - /** * Build a Set-Cookie Response for session operations. * Pass token='' and maxAge=0 to clear the cookie (logout). diff --git a/src/lib/server/authRequest.ts b/src/lib/server/authRequest.ts new file mode 100644 index 0000000..1a6cd11 --- /dev/null +++ b/src/lib/server/authRequest.ts @@ -0,0 +1,12 @@ +/** + * Route-level auth helper. + * Imports SESSION_SECRET from $env/dynamic/private (works in both dev and prod). + * Use this in +server.ts and +layout.server.ts files instead of auth.ts directly. + */ +import { env } from '$env/dynamic/private'; +import { requireAuth } from '$lib/server/auth'; +import type { Request } from '@sveltejs/kit'; + +export function authRequest(request: Request): boolean { + return requireAuth(request, env.SESSION_SECRET ?? ''); +} diff --git a/src/routes/admin/+layout.server.ts b/src/routes/admin/+layout.server.ts index 6f2da99..36a1267 100644 --- a/src/routes/admin/+layout.server.ts +++ b/src/routes/admin/+layout.server.ts @@ -1,5 +1,5 @@ import { redirect } from '@sveltejs/kit'; -import { authRequest } from '$lib/server/auth'; +import { authRequest } from '$lib/server/authRequest'; import { loadConfig } from '$lib/server/data'; import type { LayoutServerLoad } from './$types'; diff --git a/src/routes/admin/api/auth/login/+server.ts b/src/routes/admin/api/auth/login/+server.ts index 065b52b..6d1c73d 100644 --- a/src/routes/admin/api/auth/login/+server.ts +++ b/src/routes/admin/api/auth/login/+server.ts @@ -1,4 +1,5 @@ import { json } from '@sveltejs/kit'; +import { env } from '$env/dynamic/private'; import { verifyPassword, createSession, sessionResponse, COOKIE_MAX_AGE } from '$lib/server/auth'; import type { RequestHandler } from './$types'; @@ -10,8 +11,8 @@ export const POST: RequestHandler = async ({ request, url }) => { return json({ error: 'Password required' }, { status: 400 }); } - const passwordHash = process.env.PASSWORD_HASH ?? ''; - const sessionSecret = process.env.SESSION_SECRET ?? ''; + const passwordHash = env.PASSWORD_HASH ?? ''; + const sessionSecret = env.SESSION_SECRET ?? ''; if (!passwordHash || !sessionSecret) { console.warn('[humor-units] WARNING: PASSWORD_HASH or SESSION_SECRET env var not set.'); diff --git a/src/routes/admin/api/groups/+server.ts b/src/routes/admin/api/groups/+server.ts index 5cf9d0a..5b290d8 100644 --- a/src/routes/admin/api/groups/+server.ts +++ b/src/routes/admin/api/groups/+server.ts @@ -1,6 +1,7 @@ import { json } from '@sveltejs/kit'; import { loadData, saveData } from '$lib/server/data'; -import { authRequest, KEBAB_RE } from '$lib/server/auth'; +import { authRequest } from '$lib/server/authRequest'; +import { KEBAB_RE } from '$lib/server/auth'; import type { RequestHandler } from './$types'; import type { Group } from '$lib/types'; diff --git a/src/routes/admin/api/groups/[id]/+server.ts b/src/routes/admin/api/groups/[id]/+server.ts index 091015b..fc36cea 100644 --- a/src/routes/admin/api/groups/[id]/+server.ts +++ b/src/routes/admin/api/groups/[id]/+server.ts @@ -1,6 +1,7 @@ import { json } from '@sveltejs/kit'; import { loadData, saveData } from '$lib/server/data'; -import { authRequest, KEBAB_RE } from '$lib/server/auth'; +import { authRequest } from '$lib/server/authRequest'; +import { KEBAB_RE } from '$lib/server/auth'; import type { RequestHandler } from './$types'; import type { Group } from '$lib/types'; diff --git a/src/routes/admin/api/order/+server.ts b/src/routes/admin/api/order/+server.ts index 8f7feb9..24d67d7 100644 --- a/src/routes/admin/api/order/+server.ts +++ b/src/routes/admin/api/order/+server.ts @@ -1,6 +1,6 @@ import { json } from '@sveltejs/kit'; import { loadData, saveData } from '$lib/server/data'; -import { authRequest } from '$lib/server/auth'; +import { authRequest } from '$lib/server/authRequest'; import type { RequestHandler } from './$types'; export const PUT: RequestHandler = async ({ request }) => { diff --git a/src/routes/admin/api/units/+server.ts b/src/routes/admin/api/units/+server.ts index da711b5..5a75496 100644 --- a/src/routes/admin/api/units/+server.ts +++ b/src/routes/admin/api/units/+server.ts @@ -1,6 +1,7 @@ import { json } from '@sveltejs/kit'; import { loadData, saveData } from '$lib/server/data'; -import { authRequest, KEBAB_RE } from '$lib/server/auth'; +import { authRequest } from '$lib/server/authRequest'; +import { KEBAB_RE } from '$lib/server/auth'; import type { RequestHandler } from './$types'; import type { Unit } from '$lib/types'; diff --git a/src/routes/admin/api/units/[id]/+server.ts b/src/routes/admin/api/units/[id]/+server.ts index 0c36869..efac0ea 100644 --- a/src/routes/admin/api/units/[id]/+server.ts +++ b/src/routes/admin/api/units/[id]/+server.ts @@ -1,6 +1,7 @@ import { json } from '@sveltejs/kit'; import { loadData, saveData } from '$lib/server/data'; -import { authRequest, KEBAB_RE } from '$lib/server/auth'; +import { authRequest } from '$lib/server/authRequest'; +import { KEBAB_RE } from '$lib/server/auth'; import type { RequestHandler } from './$types'; import type { Unit } from '$lib/types';