51 lines
2.2 KiB
JavaScript
51 lines
2.2 KiB
JavaScript
const { sessionHelpers } = require('./sqlite-db');
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
function logToFile(...args) {
|
|
const msg = `[${new Date().toISOString()}] ` + args.map(a => (typeof a === 'object' ? JSON.stringify(a) : String(a))).join(' ') + '\n';
|
|
fs.appendFileSync(path.join(__dirname, 'backend.log'), msg, { encoding: 'utf8' });
|
|
}
|
|
|
|
// Express middleware to require a valid sessionId in req.headers['x-session-id'] or req.body.sessionId
|
|
// Accepts a GM bypass header 'x-gm-secret' matching process.env.GM_PASSWORD or 'bongo' for local convenience
|
|
module.exports = async function requireSession(req, res, next) {
|
|
try {
|
|
// GM bypass
|
|
const gmSecret = req.headers['x-gm-secret'] || req.query.gmSecret || req.body.gmSecret;
|
|
const gmPassword = process.env.GM_PASSWORD || 'bongo';
|
|
if (gmSecret && String(gmSecret) === String(gmPassword)) {
|
|
logToFile('SESSION: GM bypass accepted', req.method, req.originalUrl);
|
|
req.session = { data: { playerName: 'GM' }, playerName: 'GM' };
|
|
req.sessionPlayerName = 'GM';
|
|
return next();
|
|
}
|
|
|
|
// Ensure req.body is always an object
|
|
if (typeof req.body !== 'object' || req.body === null) req.body = {};
|
|
const sessionId = req.headers['x-session-id'] || req.body.sessionId || req.query.sessionId;
|
|
if (!sessionId) {
|
|
logToFile('SESSION: Missing sessionId', req.method, req.originalUrl);
|
|
return res.status(401).json({ error: 'Session required' });
|
|
}
|
|
|
|
const session = sessionHelpers.get(sessionId);
|
|
if (!session) {
|
|
logToFile('SESSION: Not found', sessionId, req.method, req.originalUrl);
|
|
return res.status(401).json({ error: 'Invalid or expired session' });
|
|
}
|
|
|
|
if (new Date(session.expiresAt) < new Date()) {
|
|
logToFile('SESSION: Expired', sessionId, req.method, req.originalUrl);
|
|
return res.status(401).json({ error: 'Invalid or expired session' });
|
|
}
|
|
|
|
logToFile('SESSION: Valid', sessionId, session.data.playerName, req.method, req.originalUrl);
|
|
req.session = session;
|
|
req.sessionPlayerName = session.data.playerName;
|
|
next();
|
|
} catch (err) {
|
|
logToFile('SESSION: Error', err && err.message ? err.message : String(err));
|
|
return res.status(500).json({ error: 'Session validation failed' });
|
|
}
|
|
};
|