24 lines
661 B
JavaScript
24 lines
661 B
JavaScript
|
const crypto = require('crypto');
|
||
|
|
|
||
|
|
function timingSafeEqual(a, b) {
|
||
|
|
const bufA = Buffer.from(String(a));
|
||
|
|
const bufB = Buffer.from(String(b));
|
||
|
|
if (bufA.length !== bufB.length) return false;
|
||
|
|
return crypto.timingSafeEqual(bufA, bufB);
|
||
|
|
}
|
||
|
|
|
||
|
|
function isValidAdminKey(key) {
|
||
|
|
const expected = process.env.ADMIN_PASSWORD;
|
||
|
|
return Boolean(expected) && Boolean(key) && timingSafeEqual(key, expected);
|
||
|
|
}
|
||
|
|
|
||
|
|
function requireAdmin(req, res, next) {
|
||
|
|
const key = req.get('x-admin-key');
|
||
|
|
if (!isValidAdminKey(key)) {
|
||
|
|
return res.status(401).json({ error: "Clé admin invalide ou manquante" });
|
||
|
|
}
|
||
|
|
next();
|
||
|
|
}
|
||
|
|
|
||
|
|
module.exports = { requireAdmin, isValidAdminKey };
|