Janady13/llms-txt-hub / apps/web/app/api/debug/_utils.ts

Source identity

Field	Recorded value
Source type	GitHub source
Original record	Janady13/llms-txt-hub / apps/web/app/api/debug/_utils.ts
Date	Not specified in source
Repository	Janady13/llms-txt-hub
Revision	e0f4bf978d4df168369c7601d9c5f5ea89e84377
Branch	main
Path or archive member	apps/web/app/api/debug/_utils.ts
Original SHA-256	141238d19ad5ecc8b06ffe1cedfeeb859af3e7715f3979cf0b5d6ec5ce809619
Git blob SHA	e3acbb213fe587e75f146b2a3c4c4fa2736a7798
Reading-copy SHA-256	141238d19ad5ecc8b06ffe1cedfeeb859af3e7715f3979cf0b5d6ec5ce809619

Original source ↗

Recovered source transcript

Download complete source text ↓44 lines · 1.6 KB

import crypto from 'node:crypto'
import { auth } from '@thedaviddias/auth'
import { NextResponse } from 'next/server'

type DebugAccessSuccess = { ok: true; userId: string }
type DebugAccessFailure = { ok: false; response: NextResponse }
export type DebugAccessResult = DebugAccessSuccess | DebugAccessFailure

/**
 * Compare tokens using constant-time semantics to reduce timing leakage.
 */
function tokensMatch(provided: string, expected: string): boolean {
  const providedBuf = Buffer.from(provided)
  const expectedBuf = Buffer.from(expected)
  return (
    providedBuf.length === expectedBuf.length && crypto.timingSafeEqual(providedBuf, expectedBuf)
  )
}

/**
 * Restrict debug endpoints to authenticated users in non-production environments.
 * Optionally supports additional shared-secret hardening via DEBUG_API_TOKEN.
 */
export async function ensureDebugAccess(request?: Request): Promise<DebugAccessResult> {
  if (process.env.NODE_ENV === 'production') {
    return { ok: false, response: NextResponse.json({ error: 'Not found' }, { status: 404 }) }
  }

  const session = await auth()
  if (!session?.user?.id) {
    return { ok: false, response: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }) }
  }

  const requiredToken = process.env.DEBUG_API_TOKEN
  if (requiredToken) {
    const providedToken = request?.headers.get('x-debug-token')
    if (!providedToken || !tokensMatch(providedToken, requiredToken)) {
      return { ok: false, response: NextResponse.json({ error: 'Forbidden' }, { status: 403 }) }
    }
  }

  return { ok: true, userId: session.user.id }
}