hahano/proxy.js at main · codingjlu/hahano · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
import { NextResponse } from "next/server"
import {
  decrypt,
  decryptRefreshToken,
  encrypt,
  encryptRefreshToken
} from "@/server/session/session"
import { cookies } from "next/headers"

const protectedRoutes = ["/"]
const publicRoutes = ["/login", "/signup"]

const ACCESS_TOKEN_MS = 5 * 60 * 1000
const REFRESH_TOKEN_MS = 7 * 24 * 60 * 60 * 1000

export default async function proxy(req) {
  const path = req.nextUrl.pathname
  const isProtectedRoute = protectedRoutes.includes(path)
  const isPublicRoute = publicRoutes.includes(path)

  const cookieStore = await cookies()
  const accessCookie = cookieStore.get("session")?.value
  const refreshCookie = cookieStore.get("refresh_token")?.value

  let session = await decrypt(accessCookie)

  if (!session?.userId && refreshCookie) {
    const refreshPayload = await decryptRefreshToken(refreshCookie)

    if (refreshPayload?.userId) {
      const accessExpires = new Date(Date.now() + ACCESS_TOKEN_MS)
      const refreshExpires = new Date(Date.now() + REFRESH_TOKEN_MS)

      const newAccessToken = await encrypt({
        userId: refreshPayload.userId,
        expiresAt: accessExpires.toISOString()
      })
      const newRefreshToken = await encryptRefreshToken({
        userId: refreshPayload.userId,
        expiresAt: refreshExpires.toISOString()
      })

      const response = NextResponse.next()

      response.cookies.set("session", newAccessToken, {
        httpOnly: true,
        secure: true,
        expires: accessExpires,
        sameSite: "lax",
        path: "/"
      })

      response.cookies.set("refresh_token", newRefreshToken, {
        httpOnly: true,
        secure: true,
        expires: refreshExpires,
        sameSite: "lax",
        path: "/"
      })

      if (isPublicRoute) {
        const redirectResponse = NextResponse.redirect(
          new URL("/", req.nextUrl)
        )
        redirectResponse.cookies.set("session", newAccessToken, {
          httpOnly: true,
          secure: true,
          expires: accessExpires,
          sameSite: "lax",
          path: "/"
        })
        redirectResponse.cookies.set("refresh_token", newRefreshToken, {
          httpOnly: true,
          secure: true,
          expires: refreshExpires,
          sameSite: "lax",
          path: "/"
        })
        return redirectResponse
      }

      return response
    }

    if (isProtectedRoute) {
      const response = NextResponse.redirect(new URL("/login", req.nextUrl))
      response.cookies.delete("session")
      response.cookies.delete("refresh_token")
      return response
    }
  }

  if (isProtectedRoute && !session?.userId) {
    return NextResponse.redirect(new URL("/login", req.nextUrl))
  }

  if (isPublicRoute && session?.userId) {
    return NextResponse.redirect(new URL("/", req.nextUrl))
  }

  if (session?.userId) {
    const accessExpires = new Date(Date.now() + ACCESS_TOKEN_MS)
    const newAccessToken = await encrypt({
      userId: session.userId,
      expiresAt: accessExpires.toISOString()
    })

    const response = NextResponse.next()
    response.cookies.set("session", newAccessToken, {
      httpOnly: true,
      secure: true,
      expires: accessExpires,
      sameSite: "lax",
      path: "/"
    })
    return response
  }

  return NextResponse.next()
}

export const config = {
  matcher: ["/((?!api|_next/static|_next/image|.*\\.png$).*)"]
}