selenite/backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add a hard kill switch for the proxy

Browse Source 
PROXY_DISABLED short-circuits all three gate points (status check, the
gated route, and the wisp upgrade handler) to closed, so nobody gets in
even with the right password or a cookie from before this was flipped on
This commit is contained in:
first@lynx.com
2026-10-01 00:30:48 -04:00
parent cc9fd16cf4
commit 1bd2ad7c01
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
index.js
View File

@ -85,6 +85,9 @@ app.use(express.json({ limit: "10mb" }));
app.use(express.urlencoded({ extended: false })); app.use(express.urlencoded({ extended: false }));
app.use(express.text()); app.use(express.text());
// hard kill switch: when true, the proxy is unreachable for everyone, no exceptions -
// existing unlock cookies, a correct beta code, none of it matters while this is true.
const PROXY_DISABLED = true;
const proxyPasswordPath = path.join(process.env.DATA_PATH, ".cache_meta"); const proxyPasswordPath = path.join(process.env.DATA_PATH, ".cache_meta");
function getProxyPassword() { function getProxyPassword() {
try { try {
@ -101,11 +104,13 @@ function proxyUnlockToken() {
return crypto.createHash("sha256").update(password).digest("hex"); return crypto.createHash("sha256").update(password).digest("hex");
} }
function isProxyUnlocked(req) { function isProxyUnlocked(req) {
if (PROXY_DISABLED) return false;
const expected = proxyUnlockToken(); const expected = proxyUnlockToken();
if (!expected) return true; if (!expected) return true;
return req.cookies.proxy_unlock === expected; return req.cookies.proxy_unlock === expected;
} }
function isProxyUnlockedRawCookieHeader(cookieHeader) { function isProxyUnlockedRawCookieHeader(cookieHeader) {
if (PROXY_DISABLED) return false;
const expected = proxyUnlockToken(); const expected = proxyUnlockToken();
if (!expected) return true; if (!expected) return true;
const match = (cookieHeader || "").split(";").map((c) => c.trim()).find((c) => c.startsWith("proxy_unlock=")); const match = (cookieHeader || "").split(";").map((c) => c.trim()).find((c) => c.startsWith("proxy_unlock="));
@ -113,6 +118,10 @@ function isProxyUnlockedRawCookieHeader(cookieHeader) {
return decodeURIComponent(match.slice("proxy_unlock=".length)) === expected; return decodeURIComponent(match.slice("proxy_unlock=".length)) === expected;
} }
app.post("/api/proxy/unlock", (req, res) => { app.post("/api/proxy/unlock", (req, res) => {
if (PROXY_DISABLED) {
res.status(400).send({ success: false, message: "beta access is currently disabled." });
return;
}
const password = getProxyPassword(); const password = getProxyPassword();
if (!password) { if (!password) {
res.status(400).send({ success: false, message: "beta access is not configured." }); res.status(400).send({ success: false, message: "beta access is not configured." });