cccb3123ed
- Add Redis-based sliding window rate limiting on login, register, forgot-password, reset-password - Fix user enumeration: register returns generic 200 for both new and existing emails - Add Redis authentication (requirepass) and password in .env - Docker network isolation: postgres/redis on internal-only network - Whitelist Stripe redirect origins (prevent open redirect) - Add 10MB request size limit on trace ingestion - Limit API keys to 10 per user - Add CORS headers via middleware (whitelist agentlens.vectry.tech + localhost) - Reduce JWT max age from 30 days to 7 days
88 lines
2.3 KiB
TypeScript
88 lines
2.3 KiB
TypeScript
import NextAuth from "next-auth";
|
|
import { NextResponse } from "next/server";
|
|
import authConfig from "./auth.config";
|
|
|
|
const { auth } = NextAuth(authConfig);
|
|
|
|
const publicPaths = [
|
|
"/",
|
|
"/docs",
|
|
"/api/auth",
|
|
"/api/traces",
|
|
"/api/health",
|
|
"/api/stripe/webhook",
|
|
"/forgot-password",
|
|
"/reset-password",
|
|
"/verify-email",
|
|
];
|
|
|
|
function isPublicPath(pathname: string): boolean {
|
|
return publicPaths.some(
|
|
(p) => pathname === p || pathname.startsWith(`${p}/`)
|
|
);
|
|
}
|
|
|
|
const ALLOWED_ORIGINS = new Set([
|
|
"https://agentlens.vectry.tech",
|
|
"http://localhost:3000",
|
|
]);
|
|
|
|
function corsHeaders(origin: string | null): Record<string, string> {
|
|
const allowedOrigin = origin && ALLOWED_ORIGINS.has(origin)
|
|
? origin
|
|
: "https://agentlens.vectry.tech";
|
|
return {
|
|
"Access-Control-Allow-Origin": allowedOrigin,
|
|
"Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
|
|
"Access-Control-Allow-Headers": "Content-Type, Authorization",
|
|
"Access-Control-Max-Age": "86400",
|
|
};
|
|
}
|
|
|
|
export default auth((req) => {
|
|
const { pathname } = req.nextUrl;
|
|
const isLoggedIn = !!req.auth;
|
|
const origin = req.headers.get("origin");
|
|
|
|
if (req.method === "OPTIONS") {
|
|
return new NextResponse(null, { status: 204, headers: corsHeaders(origin) });
|
|
}
|
|
|
|
const response = (() => {
|
|
if (isPublicPath(pathname)) {
|
|
if (isLoggedIn && (pathname === "/login" || pathname === "/register")) {
|
|
return NextResponse.redirect(new URL("/dashboard", req.nextUrl.origin));
|
|
}
|
|
return NextResponse.next();
|
|
}
|
|
|
|
if (pathname === "/login" || pathname === "/register") {
|
|
if (isLoggedIn) {
|
|
return NextResponse.redirect(new URL("/dashboard", req.nextUrl.origin));
|
|
}
|
|
return NextResponse.next();
|
|
}
|
|
|
|
if (pathname.startsWith("/dashboard") && !isLoggedIn) {
|
|
const loginUrl = new URL("/login", req.nextUrl.origin);
|
|
loginUrl.searchParams.set("callbackUrl", pathname);
|
|
return NextResponse.redirect(loginUrl);
|
|
}
|
|
|
|
return NextResponse.next();
|
|
})();
|
|
|
|
if (pathname.startsWith("/api/")) {
|
|
const headers = corsHeaders(origin);
|
|
for (const [key, value] of Object.entries(headers)) {
|
|
response.headers.set(key, value);
|
|
}
|
|
}
|
|
|
|
return response;
|
|
});
|
|
|
|
export const config = {
|
|
matcher: ["/((?!_next/static|_next/image|favicon.ico|og-image.png).*)"],
|
|
};
|