Arnaud
acc93de708
Uses better-auth's built-in twoFactor plugin rather than hand-rolling TOTP — adds the two_factors table and users.twoFactorEnabled, wires the server/client plugins (allowPasswordless: true so OAuth-only accounts aren't locked out of managing 2FA), and adds a custom rate limit for the verify endpoints (5/min — far stricter than the default 100/10s, since a 6-digit code has a much smaller keyspace than a password). New Settings → Security section walks through enable (password confirm -> QR + backup codes -> confirm a live code before it's actually turned on, per the plugin's default flow) and disable. New /verify-2fa page handles the post-password mid-login step, with a backup-code fallback. Verified live end-to-end: enable, confirm, forced re-auth on next sign-in, TOTP accepted, backup code accepted (single-use), disable. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
77 lines
3.4 KiB
TypeScript
77 lines
3.4 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { getSessionCookie } from "better-auth/cookies";
|
|
import { applyRateLimit } from "@/lib/rate-limit";
|
|
|
|
const PUBLIC_PATHS = ["/login", "/signup", "/verify-email", "/verify-2fa", "/forgot-password", "/reset-password", "/api/auth", "/r/", "/u/", "/s/", "/docs", "/api/v1/openapi.json", "/api/webhooks", "/api/v1/invites/", "/api/internal/"];
|
|
const ADMIN_PATHS = ["/admin"];
|
|
|
|
// A public-editable shopping list's own items endpoint — no session cookie to
|
|
// require, since an anonymous visitor's only credential is the link (the list
|
|
// id) itself. getShoppingListAccess (lib/shopping-list-access.ts) is what
|
|
// actually enforces that the specific list allows this; a non-public list
|
|
// hitting this route just gets a 404/403 from the handler, same as today.
|
|
const SHOPPING_LIST_ITEMS_RE = /^\/api\/v1\/shopping-lists\/[^/]+\/items(\/|$)/;
|
|
|
|
// Unauthenticated, publicly-linked pages/endpoints (shared recipes/shopping
|
|
// lists) — no per-user identity to key on, so rate-limit by IP to deter abuse.
|
|
const IP_RATE_LIMITED_PATHS = ["/r/", "/s/"];
|
|
const IP_RATE_LIMIT = 60;
|
|
const IP_RATE_LIMIT_WINDOW_SECONDS = 60;
|
|
|
|
function getClientIp(request: NextRequest): string {
|
|
const forwardedFor = request.headers.get("x-forwarded-for");
|
|
if (forwardedFor) return forwardedFor.split(",")[0]!.trim();
|
|
return request.headers.get("x-real-ip") ?? "unknown";
|
|
}
|
|
|
|
export async function proxy(request: NextRequest) {
|
|
const { pathname } = request.nextUrl;
|
|
|
|
const sessionCookie = getSessionCookie(request);
|
|
const isShoppingListItems = SHOPPING_LIST_ITEMS_RE.test(pathname);
|
|
// Only treat the items endpoint as public for requests with no session —
|
|
// an authenticated collaborator's own polling/edits should never be bucketed
|
|
// into the anonymous-visitor IP rate limit below.
|
|
const isPublic = PUBLIC_PATHS.some((p) => pathname.startsWith(p)) || (isShoppingListItems && !sessionCookie);
|
|
const isAdmin = ADMIN_PATHS.some((p) => pathname.startsWith(p));
|
|
const isApi = pathname.startsWith("/api/v1");
|
|
|
|
if (isPublic) {
|
|
if (IP_RATE_LIMITED_PATHS.some((p) => pathname.startsWith(p)) || isShoppingListItems) {
|
|
const ip = getClientIp(request);
|
|
const limited = await applyRateLimit(`rl:public:${ip}`, IP_RATE_LIMIT, IP_RATE_LIMIT_WINDOW_SECONDS);
|
|
if (limited) return limited;
|
|
}
|
|
return NextResponse.next();
|
|
}
|
|
|
|
// API-key clients authenticate via `Authorization: Bearer ek_...`, not a
|
|
// session cookie — they'd otherwise be rejected here before ever reaching
|
|
// requireSessionOrApiKey (lib/api-auth.ts), which is the only place that
|
|
// actually verifies the key. Defer to it instead of requiring a cookie.
|
|
const authHeader = request.headers.get("authorization");
|
|
const hasApiKeyHeader = isApi && authHeader?.startsWith("Bearer ek_");
|
|
|
|
if (!sessionCookie && !hasApiKeyHeader) {
|
|
if (isApi) {
|
|
return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
|
|
}
|
|
return NextResponse.redirect(new URL("/login", request.url));
|
|
}
|
|
|
|
if (isAdmin) {
|
|
// Role check happens inside admin pages — middleware only checks auth
|
|
// Full role verification requires DB lookup, done server-side in admin layout
|
|
}
|
|
|
|
return NextResponse.next();
|
|
}
|
|
|
|
export default proxy;
|
|
|
|
export const config = {
|
|
matcher: [
|
|
"/((?!_next/static|_next/image|favicon.ico|icon.svg|icon-192.svg|icon-512.svg|manifest.webmanifest|sw.js|public/).*)",
|
|
],
|
|
};
|