46 lines
1.3 KiB
TypeScript
46 lines
1.3 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
|
|
/**
|
|
* GET /api/verify-access
|
|
*
|
|
* Returns whether password protection is enabled at runtime.
|
|
* This is called by the PasswordGate client component on mount
|
|
* to determine if it should show the password prompt.
|
|
*/
|
|
export async function GET() {
|
|
const accessKey = process.env.ACCESS_KEY;
|
|
const enabled = !!accessKey;
|
|
return NextResponse.json({ enabled });
|
|
}
|
|
|
|
/**
|
|
* POST /api/verify-access
|
|
*
|
|
* Validates a submitted key against the ACCESS_KEY environment variable.
|
|
* Returns { valid: true } if matched, { valid: false } otherwise.
|
|
*
|
|
* If ACCESS_KEY is not set, all keys are rejected (locked by default).
|
|
*/
|
|
export async function POST(request: Request) {
|
|
try {
|
|
const body = await request.json();
|
|
const submitted = body?.key;
|
|
|
|
if (typeof submitted !== "string" || !submitted) {
|
|
return NextResponse.json({ valid: false }, { status: 400 });
|
|
}
|
|
|
|
const accessKey = process.env.ACCESS_KEY;
|
|
|
|
// If no ACCESS_KEY is configured, reject everything
|
|
if (!accessKey) {
|
|
return NextResponse.json({ valid: false }, { status: 403 });
|
|
}
|
|
|
|
const valid = submitted === accessKey;
|
|
return NextResponse.json({ valid }, { status: valid ? 200 : 401 });
|
|
} catch {
|
|
return NextResponse.json({ valid: false }, { status: 400 });
|
|
}
|
|
}
|