Antti | kirjautuminen ja rekistöröityminen sekä authentication

.env.example

@@ -1 +1,5 @@
-DATABASE_URL="postgresql://databaseusername:databasepassword@localhost:5432/mydb?schema=public"
+DATABASE_URL="postgresql://databaseusername:databasepassword@localhost:5432/mydb?schema=public" # README.md's section "Setting the environment variables" will help with this
+POSTGRES_USERNAME="databaseusername" # Postgres database's username. It is same as DATABASE_URL's databaseusername
+POSTGRES_PASSWORD="databasepassword" # Postgres database's password. It is same as DATABASE_URL's databasepassword
+HEADER_KEY="your-secret-key-here" # used in custom header
+HEADER_VALUE="your-secret-key-here" # used in custom header

backend/auth.ts

@@ -0,0 +1,31 @@
+import { PrismaAdapter } from '@lucia-auth/adapter-prisma';
+import { Lucia } from 'lucia';
+import prisma from '~/prisma';
+import { webcrypto } from 'crypto';
+import type { User } from '~/shared/types';
+
+globalThis.crypto = webcrypto as Crypto;
+
+const adapter = new PrismaAdapter(prisma.session, prisma.user);
+
+export const lucia = new Lucia(adapter, {
+  sessionCookie: {
+    attributes: {
+      secure: process.env.NODE_ENV === 'production',
+    },
+  },
+  getUserAttributes(attributes: Partial<User>) {
+    return {
+      email: attributes.email,
+    };
+  },
+});
+
+declare module 'lucia' {
+  interface Register {
+    Lucia: typeof lucia;
+    DatabaseUserAttributes: DatabaseUserAttributes;
+  }
+}
+
+interface DatabaseUserAttributes extends User {}

middleware.ts

@@ -0,0 +1,32 @@
+import { verifyRequestOrigin } from 'lucia';
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+
+export const CUSTOM_HEADER = {
+  key: process.env.HEADER_KEY,
+  value: process.env.HEADER_VALUE,
+} as const;
+
+//eslint-disable-next-line
+export async function middleware(req: NextRequest): Promise<NextResponse> {
+  if (req.method === 'GET') {
+    return NextResponse.next();
+  }
+  const originHeader = req.headers.get('Origin');
+  const hostHeader = req.headers.get('Host');
+
+  if (CUSTOM_HEADER.key !== undefined && CUSTOM_HEADER.value !== undefined) {
+    if (req.headers.get(CUSTOM_HEADER.key) === CUSTOM_HEADER.value) {
+      return NextResponse.next();
+    }
+  }
+
+  if (
+    !originHeader ||
+    !hostHeader ||
+    !verifyRequestOrigin(originHeader, [hostHeader])
+  ) {
+    return new NextResponse(null, { status: 403 });
+  }
+  return NextResponse.next();
+}