selenite/backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

move beta access password out of .env into a data file

Browse Source 
lets it be changed live without a redeploy/restart, and sidesteps
whatever was causing PROXY_PASSWORD not to reach process.env in prod
This commit is contained in:
first@lynx.com
2026-08-24 17:01:41 -04:00
parent a6ac6aaa4f
commit cc9fd16cf4
2 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
.env.example
View File

@ -8,5 +8,4 @@ DATA_PATH=where_to_store_data
NODE_ENV=production NODE_ENV=production
DISCORD_AI_WEBHOOK=discord_webhook_url DISCORD_AI_WEBHOOK=discord_webhook_url
PROCESSING_SERVER=https://git.ceres.rip/selenite/processing PROCESSING_SERVER=https://git.ceres.rip/selenite/processing
PROCESSING_SERVER_SECRET=secret PROCESSING_SERVER_SECRET=secret
PROXY_PASSWORD=change_me

21
index.js
View File

@ -18,6 +18,7 @@ import { callAI } from "./ai.js";
import { Readable } from 'stream'; import { Readable } from 'stream';
import os from "node:os"; import os from "node:os";
import crypto from "node:crypto"; import crypto from "node:crypto";
import { readFileSync, existsSync } from "node:fs";
import { server as wisp, logging as wispLogging } from "@mercuryworkshop/wisp-js/server"; import { server as wisp, logging as wispLogging } from "@mercuryworkshop/wisp-js/server";
import { scramjetPath } from "@mercuryworkshop/scramjet/path"; import { scramjetPath } from "@mercuryworkshop/scramjet/path";
import { libcurlPath } from "@mercuryworkshop/libcurl-transport"; import { libcurlPath } from "@mercuryworkshop/libcurl-transport";
@ -84,9 +85,20 @@ app.use(express.json({ limit: "10mb" }));
app.use(express.urlencoded({ extended: false })); app.use(express.urlencoded({ extended: false }));
app.use(express.text()); app.use(express.text());
const proxyPasswordPath = path.join(process.env.DATA_PATH, ".cache_meta");
function getProxyPassword() {
try {
if (!existsSync(proxyPasswordPath)) return null;
const value = readFileSync(proxyPasswordPath, "utf8").trim();
return value || null;
} catch {
return null;
}
}
function proxyUnlockToken() { function proxyUnlockToken() {
if (!process.env.PROXY_PASSWORD) return null; const password = getProxyPassword();
return crypto.createHash("sha256").update(process.env.PROXY_PASSWORD).digest("hex"); if (!password) return null;
return crypto.createHash("sha256").update(password).digest("hex");
} }
function isProxyUnlocked(req) { function isProxyUnlocked(req) {
const expected = proxyUnlockToken(); const expected = proxyUnlockToken();
@ -101,11 +113,12 @@ function isProxyUnlockedRawCookieHeader(cookieHeader) {
return decodeURIComponent(match.slice("proxy_unlock=".length)) === expected; return decodeURIComponent(match.slice("proxy_unlock=".length)) === expected;
} }
app.post("/api/proxy/unlock", (req, res) => { app.post("/api/proxy/unlock", (req, res) => {
if (!process.env.PROXY_PASSWORD) { const password = getProxyPassword();
if (!password) {
res.status(400).send({ success: false, message: "beta access is not configured." }); res.status(400).send({ success: false, message: "beta access is not configured." });
return; return;
} }
if (req.body.password === process.env.PROXY_PASSWORD) { if (req.body.password === password) {
res.cookie("proxy_unlock", proxyUnlockToken(), { res.cookie("proxy_unlock", proxyUnlockToken(), {
httpOnly: true, httpOnly: true,
maxAge: 1000 * 60 * 60 * 24 * 365, maxAge: 1000 * 60 * 60 * 24 * 365,