server/auth.js - master - stasnorman/cif_platform

server/auth.js
71 строка2 KB
Stas Makievsky
first_commit
30 окт 2025, 21:04
30 окт 2025, 21:0453daf0f
const jwt = require('jsonwebtoken');

const ACCESS_TTL = '2h';              // срок жизни сессии
const COOKIE_USER = 'dd_user';
const COOKIE_ADMIN = 'dd_admin';

function sign(payload, secret, ttl = ACCESS_TTL) {
  return jwt.sign(payload, secret, { expiresIn: ttl });
}
function verify(token, secret) {
  try { return jwt.verify(token, secret); }
  catch { return null; }
}

function userCookieName() { return COOKIE_USER; }
function adminCookieName() { return COOKIE_ADMIN; }

function setCookie(res, name, token) {
  const isProd = process.env.NODE_ENV === 'production';
  res.cookie(name, token, {
    httpOnly: true,
    sameSite: 'lax',
    secure: isProd,
    path: '/',
    maxAge: 1000 * 60 * 60 * 2
  });
}

function clearCookie(res, name) {
  res.clearCookie(name, { path: '/' });
}

function requireAdmin(req, res, next) {
  const token = req.cookies[adminCookieName()];
  const payload = verify(token, process.env.JWT_SECRET);
  if (!payload || payload.role !== 'admin') {
    return res.status(401).json({ error: 'unauthorized' });
  }
  req.admin = payload;
  next();
}

function requireUser(req, res, next) {
  const token = req.cookies[userCookieName()];
  const payload = verify(token, process.env.JWT_SECRET);
  if (!payload || payload.role !== 'user') {
    return res.status(401).json({ error: 'unauthorized' });
  }
  req.user = payload;
  next();
}

// доп. фильтр для ручек конкретного теста
function requireUserForCode(paramName = 'code') {
  return (req, res, next) => {
    const token = req.cookies[userCookieName()];
    const payload = verify(token, process.env.JWT_SECRET);
    if (!payload || payload.role !== 'user' || payload.code !== String(req.params[paramName])) {
      return res.status(401).json({ error: 'unauthorized' });
    }
    req.user = payload;
    next();
  };
}

module.exports = {
  sign, verify,
  setCookie, clearCookie,
  requireAdmin, requireUser, requireUserForCode,
  userCookieName, adminCookieName
};