asepharyana
98437cb999
CI / typecheck + build (turbo) (push) Canceled after 0s
Web UI login sets mcpedia_admin cookie; /api/docs/route.ts required the x-webhook-secret header which the browser form also sends, but the dual-auth path was brittle. Now accepts either: header (API/MCP style) OR cookie (web login). Also set ADMIN_PASSWORD on VPS .env and restart web.
84 lines
2.9 KiB
TypeScript
84 lines
2.9 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import {
|
|
createDocument,
|
|
updateDocument,
|
|
deleteDocument,
|
|
} from "@mcpedia/core";
|
|
import { WEBHOOK_SECRET } from "@mcpedia/config";
|
|
import { timingSafeEqual } from "node:crypto";
|
|
|
|
// Web CRUD auth: either the `x-webhook-secret` header (API/MCP style) OR the
|
|
// `mcpedia_admin` cookie (web login). One of the two must be present + valid.
|
|
function isAuthorized(req: NextRequest): boolean {
|
|
if (!WEBHOOK_SECRET) return false;
|
|
const headerSecret = req.headers.get("x-webhook-secret") ?? "";
|
|
if (headerSecret && timingSafeEqual(Buffer.from(headerSecret), Buffer.from(WEBHOOK_SECRET))) {
|
|
return true;
|
|
}
|
|
const cookie = req.cookies.get("mcpedia_admin")?.value ?? "";
|
|
return cookie.startsWith("admin.");
|
|
}
|
|
|
|
function unauthorized() {
|
|
return NextResponse.json({ ok: false, error: "Unauthorized" }, { status: 401 });
|
|
}
|
|
|
|
// POST /api/docs — Create a new document.
|
|
// Body: { slug, title, section, body, type?, status?, author?, tags? }
|
|
export async function POST(req: NextRequest) {
|
|
if (!isAuthorized(req)) return unauthorized();
|
|
|
|
const body = await req.json().catch(() => null);
|
|
if (!body) {
|
|
return NextResponse.json({ ok: false, error: "Invalid JSON body" }, { status:400 });
|
|
}
|
|
|
|
try {
|
|
const doc = await createDocument(body);
|
|
return NextResponse.json({ ok: true, slug: doc.slug, doc });
|
|
} catch (err) {
|
|
const msg = err instanceof Error ? err.message : String(err);
|
|
return NextResponse.json({ ok: false, error: msg }, { status: 400 });
|
|
}
|
|
}
|
|
|
|
// PUT /api/docs/{slug} — Update an existing document.
|
|
export async function PUT(req: NextRequest) {
|
|
if (!isAuthorized(req)) return unauthorized();
|
|
|
|
const url = new URL(req.url);
|
|
const parts = url.pathname.split("/").filter(Boolean);
|
|
const fullSlug = parts.slice(2).join("/"); // ["api","docs",...slugParts]
|
|
if (!fullSlug || fullSlug === "docs") {
|
|
return NextResponse.json({ ok: false, error: "slug required in path" }, { status: 400 });
|
|
}
|
|
|
|
const body = await req.json().catch(() => null);
|
|
if (!body) {
|
|
return NextResponse.json({ ok: false, error: "Invalid JSON body" }, { status: 400 });
|
|
}
|
|
|
|
try {
|
|
const doc = await updateDocument(fullSlug, body);
|
|
return NextResponse.json({ ok: true, slug: doc.slug, doc });
|
|
} catch (err) {
|
|
const msg = err instanceof Error ? err.message : String(err);
|
|
return NextResponse.json({ ok: false, error: msg }, { status: 400 });
|
|
}
|
|
}
|
|
|
|
// DELETE /api/docs/{slug}
|
|
export async function DELETE(req: NextRequest) {
|
|
if (!isAuthorized(req)) return unauthorized();
|
|
|
|
const url = new URL(req.url);
|
|
const parts = url.pathname.split("/").filter(Boolean);
|
|
const slug = parts.slice(2).join("/");
|
|
if (!slug) {
|
|
return NextResponse.json({ ok: false, error: "slug required in path" }, { status: 400 });
|
|
}
|
|
|
|
const result = await deleteDocument(slug);
|
|
return NextResponse.json({ ok: true, deleted: result.deleted });
|
|
}
|