87 lines
2.6 KiB
JavaScript
87 lines
2.6 KiB
JavaScript
import { NextResponse } from 'next/server';
|
|
|
|
function getValidUsers() {
|
|
const users = {};
|
|
|
|
// Support multiple users format: "user1:pass1,user2:pass2"
|
|
if (process.env.BASIC_AUTH_USERS) {
|
|
const pairs = process.env.BASIC_AUTH_USERS.split(',');
|
|
for (const pair of pairs) {
|
|
const trimmed = pair.trim();
|
|
if (!trimmed) continue;
|
|
// Split on first colon
|
|
const colonIdx = trimmed.indexOf(':');
|
|
if (colonIdx !== -1) {
|
|
const username = trimmed.slice(0, colonIdx).trim().toLowerCase();
|
|
const password = trimmed.slice(colonIdx + 1).trim();
|
|
if (username && password) {
|
|
users[username] = password;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// Fallback / Single user format: BASIC_AUTH_USER and BASIC_AUTH_PASSWORD
|
|
if (process.env.BASIC_AUTH_USER && process.env.BASIC_AUTH_PASSWORD) {
|
|
const username = process.env.BASIC_AUTH_USER.trim().toLowerCase();
|
|
const password = process.env.BASIC_AUTH_PASSWORD.trim();
|
|
if (username && password) {
|
|
users[username] = password;
|
|
}
|
|
}
|
|
|
|
return users;
|
|
}
|
|
|
|
export function middleware(req) {
|
|
const basicAuth = req.headers.get('authorization');
|
|
const validUsers = getValidUsers();
|
|
|
|
// If any credentials are configured in ENV, enforce auth
|
|
if (Object.keys(validUsers).length > 0) {
|
|
if (basicAuth) {
|
|
try {
|
|
const authValue = basicAuth.split(' ')[1];
|
|
if (authValue) {
|
|
const decoded = atob(authValue);
|
|
const colonIdx = decoded.indexOf(':');
|
|
if (colonIdx !== -1) {
|
|
const providedUser = decoded.slice(0, colonIdx).trim().toLowerCase();
|
|
const providedPwd = decoded.slice(colonIdx + 1);
|
|
|
|
if (validUsers[providedUser] && validUsers[providedUser] === providedPwd) {
|
|
return NextResponse.next();
|
|
}
|
|
}
|
|
}
|
|
} catch (err) {
|
|
// Ignore decoding errors and fall through to 401
|
|
}
|
|
}
|
|
|
|
// Return 401 Unauthorized if credentials don't match or are missing
|
|
return new NextResponse('Auth required', {
|
|
status: 401,
|
|
headers: {
|
|
'WWW-Authenticate': 'Basic realm="Secure Area"',
|
|
},
|
|
});
|
|
}
|
|
|
|
// If no credentials are set in ENV, allow access
|
|
return NextResponse.next();
|
|
}
|
|
|
|
// Ensure the middleware only runs for paths that need protection.
|
|
export const config = {
|
|
matcher: [
|
|
/*
|
|
* Match all request paths except for the ones starting with:
|
|
* - _next/static (static files)
|
|
* - _next/image (image optimization files)
|
|
* - favicon.ico (favicon file)
|
|
*/
|
|
'/((?!_next/static|_next/image|favicon.ico).*)',
|
|
],
|
|
};
|