jeremy
8715589cbb
- /admin: first-visit password setup (scrypt), signed 30-day session cookie, calendars add/remove/reorder/rename/color/hide, masked URLs, per-feed test, history (20) with restore; /photo-admin -> /admin#photos placeholder - settings in local /data (settings.json + auth.json + history/), seeded once from the calendar secret; dashboard + health read from settings - start.mjs drops privileges after reading secrets and runs a front proxy that stamps the real client IP; admin refuses non-LAN and proxied requests - deploy: HOBBS_DATA_DIR=/var/lib/hobbs-organizer/data, image 1.1.0 (1.0.0 kept) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E9NnVEico3WvFxLyjy1iW3
17 lines
1.0 KiB
TypeScript
17 lines
1.0 KiB
TypeScript
import { json, MIN_PASSWORD_LENGTH, readJsonBody, requireAdmin, setPassword, verifyPassword } from "../../../_lib/auth";
|
|
import { readAuth } from "../../../_lib/store";
|
|
|
|
export const dynamic = "force-dynamic";
|
|
|
|
/** Changes the password; signs out every other session. */
|
|
export async function POST(request: Request) {
|
|
const denied = await requireAdmin(request, { mutating: true });
|
|
if (denied) return denied;
|
|
const body = await readJsonBody<{ currentPassword?: string; newPassword?: string }>(request);
|
|
const current = typeof body?.currentPassword === "string" ? body.currentPassword : "";
|
|
const next = typeof body?.newPassword === "string" ? body.newPassword : "";
|
|
if (!(await verifyPassword(current, (await readAuth()).passwordHash))) return json({ error: "Current password is wrong." }, 401);
|
|
if (next.length < MIN_PASSWORD_LENGTH || next.length > 256) return json({ error: `Use at least ${MIN_PASSWORD_LENGTH} characters.` }, 400);
|
|
return json({ ok: true }, 200, { "Set-Cookie": await setPassword(next) });
|
|
}
|