87 lines
2.7 KiB
JavaScript
87 lines
2.7 KiB
JavaScript
// Gemeinsame Helfer für alle vitaAPI-Endpunkte (Vercel Serverless + Neon Postgres)
|
|
import { neon } from '@neondatabase/serverless';
|
|
import { randomBytes, scryptSync, timingSafeEqual } from 'node:crypto';
|
|
|
|
export const sql = neon(process.env.DATABASE_URL);
|
|
|
|
export const ONLINE_SECS = 60;
|
|
export const MAX_TEXT_LEN = 500;
|
|
export const MAX_POLL = 50;
|
|
export const PREVIEW_LEN = 38;
|
|
|
|
/* ---------------- Antwort-Protokoll (zeilenbasiert, Pipe-getrennt) ---------------- */
|
|
|
|
export function textHead(res) {
|
|
res.setHeader('Content-Type', 'text/plain; charset=utf-8');
|
|
res.setHeader('Cache-Control', 'no-store');
|
|
}
|
|
|
|
export function ok(res, body = '') {
|
|
textHead(res);
|
|
res.status(200).send(body);
|
|
}
|
|
|
|
export function fail(res, msg) {
|
|
textHead(res);
|
|
res.status(200).send(`ERR|${msg}\n`); // 200, damit der Vita-Client die Zeile sicher liest
|
|
}
|
|
|
|
/** Pipes und Zeilenumbrüche aus Nutzdaten entfernen, damit das Protokoll heil bleibt. */
|
|
export function clean(s) {
|
|
return String(s).replace(/\|/g, '¦').replace(/[\r\n]+/g, ' ');
|
|
}
|
|
|
|
/* ---------------- Parameter (GET-Query oder POST-Formulardaten) ---------------- */
|
|
|
|
export function param(req, key) {
|
|
let v = req.query?.[key];
|
|
if (v === undefined && req.body) {
|
|
if (typeof req.body === 'string') {
|
|
// Fallback, falls Vercel den Body nicht geparst hat
|
|
v = new URLSearchParams(req.body).get(key);
|
|
} else {
|
|
v = req.body[key];
|
|
}
|
|
}
|
|
return (v ?? '').toString().trim();
|
|
}
|
|
|
|
/* ---------------- Passwörter (scrypt aus Node, keine Extra-Abhängigkeit) ---------------- */
|
|
|
|
export function hashPassword(pass) {
|
|
const salt = randomBytes(16);
|
|
const hash = scryptSync(pass, salt, 64);
|
|
return `${salt.toString('hex')}:${hash.toString('hex')}`;
|
|
}
|
|
|
|
export function verifyPassword(pass, stored) {
|
|
try {
|
|
const [saltHex, hashHex] = String(stored).split(':');
|
|
if (!saltHex || !hashHex) return false;
|
|
const expected = Buffer.from(hashHex, 'hex');
|
|
const actual = scryptSync(pass, Buffer.from(saltHex, 'hex'), expected.length);
|
|
return timingSafeEqual(expected, actual);
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
export function newToken() {
|
|
return randomBytes(16).toString('hex');
|
|
}
|
|
|
|
/* ---------------- Authentifizierung ---------------- */
|
|
|
|
/** Gibt den Nutzer zurück oder null (dann hat der Aufrufer bereits geantwortet). */
|
|
export async function auth(req, res) {
|
|
const token = param(req, 'token');
|
|
if (!token) { fail(res, 'Kein Token'); return null; }
|
|
|
|
const rows = await sql`SELECT id, name FROM users WHERE token = ${token}`;
|
|
if (!rows.length) { fail(res, 'Ungueltiges Token'); return null; }
|
|
|
|
const now = Math.floor(Date.now() / 1000);
|
|
await sql`UPDATE users SET last_seen = ${now} WHERE id = ${rows[0].id}`;
|
|
return rows[0];
|
|
}
|