28783505715

Committed 06 Jul 2026 10:00AM UTC coverage: 67.645% (-0.1%) from 67.747%

Build # 28783505715

Build Type

Pull #666

github

Committed by

web-flow

Commit Message

Merge c0224c5a9 into 237b1a427

Pull Request Pull Request #666: feat(admin): add observability dashboard UI with Grafana embeds

Coverage Stats

2112 of 3495 branches covered (60.43%)

Branch coverage included in aggregate %.

136 of 205 new or added lines in 15 files covered. (66.34%)

8 existing lines in 1 file now uncovered.

4825 of 6760 relevant lines covered (71.38%)

20.24 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

80.46

/src/utils/admin-session.ts

import { timingSafeEqual } from 'crypto'
import { IncomingMessage } from 'http'

import { Settings } from '../@types/settings'
import { getPublicPathPrefix, isSecureRequest, joinPathPrefix } from './http'
import { deriveFromSecret, hmacSha256 } from './secret'

export const DEFAULT_ADMIN_SESSION_TTL_SECONDS = 86400

export const resolveAdminSessionTtlSeconds = (
  sessionTtlSeconds: number | undefined,
  defaultTtlSeconds = DEFAULT_ADMIN_SESSION_TTL_SECONDS,
): number => {
  if (typeof sessionTtlSeconds === 'number' && Number.isFinite(sessionTtlSeconds) && sessionTtlSeconds > 0) {
    return Math.floor(sessionTtlSeconds)
  }

  return defaultTtlSeconds
}

export const buildAdminSessionCookieHeader = (
  request: IncomingMessage,
  settings: Settings,
  token: string,
  maxAgeSeconds: number,
): string => {
  const cookiePath = joinPathPrefix(getPublicPathPrefix(request, settings), '/admin')
  const secure = isSecureRequest(request, settings) ? '; Secure' : ''

  return `admin_session=${token}; Path=${cookiePath}; HttpOnly; SameSite=Strict; Max-Age=${maxAgeSeconds}${secure}`
}

export const buildAdminSessionClearCookieHeader = (request: IncomingMessage, settings: Settings): string => {
  const cookiePath = joinPathPrefix(getPublicPathPrefix(request, settings), '/admin')
  const secure = isSecureRequest(request, settings) ? '; Secure' : ''

  return `admin_session=; Path=${cookiePath}; HttpOnly; SameSite=Strict; Max-Age=0${secure}`
}

export const createAdminSessionToken = (expiresAt: number): string => {
  const signature = hmacSha256(deriveFromSecret('admin-session'), `${expiresAt}`).toString('hex')
  return `${expiresAt}.${signature}`
}

export const parseAdminSessionToken = (token: string): { expiresAt: number } | undefined => {
  const separatorIndex = token.indexOf('.')
  if (separatorIndex <= 0) {
    return undefined
  }

  const expiresAt = Number(token.slice(0, separatorIndex))
  if (!Number.isFinite(expiresAt)) {
    return undefined
  }

  return { expiresAt }
}

export const isValidAdminSessionToken = (token: string, nowSeconds = Math.floor(Date.now() / 1000)): boolean => {
  const separatorIndex = token.indexOf('.')
  if (separatorIndex <= 0) {
    return false
  }

  const expiresAt = Number(token.slice(0, separatorIndex))
  const signature = token.slice(separatorIndex + 1)

  if (!Number.isFinite(expiresAt) || expiresAt <= nowSeconds || !/^[0-9a-f]+$/.test(signature)) {
    return false
  }

  const expected = hmacSha256(deriveFromSecret('admin-session'), `${expiresAt}`).toString('hex')
  const expectedBuf = Buffer.from(expected, 'utf8')
  const actualBuf = Buffer.from(signature, 'utf8')

  if (expectedBuf.length !== actualBuf.length) {
    return false
  }

  return timingSafeEqual(expectedBuf, actualBuf)
}

export const getAdminSessionTokenFromRequest = (authorizationHeader?: string, cookieHeader?: string): string | undefined => {
  if (authorizationHeader?.startsWith('Bearer ')) {
    const token = authorizationHeader.slice('Bearer '.length).trim()
    return token.length > 0 ? token : undefined
  }

  if (!cookieHeader) {
    return undefined
  }

  for (const part of cookieHeader.split(';')) {
    const [name, ...valueParts] = part.trim().split('=')
    if (name === 'admin_session') {
      const value = valueParts.join('=').trim()
      return value.length > 0 ? value : undefined
    }
  }

  return undefined
}

1	import { timingSafeEqual } from 'crypto'	2✔
2	import { IncomingMessage } from 'http'
3
4	import { Settings } from '../@types/settings'
5	import { getPublicPathPrefix, isSecureRequest, joinPathPrefix } from './http'	2✔
6	import { deriveFromSecret, hmacSha256 } from './secret'	2✔
7
8	export const DEFAULT_ADMIN_SESSION_TTL_SECONDS = 86400	2✔
9
10	export const resolveAdminSessionTtlSeconds = (	2✔
11	sessionTtlSeconds: number \| undefined,
12	defaultTtlSeconds = DEFAULT_ADMIN_SESSION_TTL_SECONDS,	8✔
13	): number => {
14	if (typeof sessionTtlSeconds === 'number' && Number.isFinite(sessionTtlSeconds) && sessionTtlSeconds > 0) {	8✔
15	return Math.floor(sessionTtlSeconds)	3✔
16	}
17
18	return defaultTtlSeconds	5✔
19	}
20
21	export const buildAdminSessionCookieHeader = (	2✔
22	request: IncomingMessage,
23	settings: Settings,
24	token: string,
25	maxAgeSeconds: number,
26	): string => {
27	const cookiePath = joinPathPrefix(getPublicPathPrefix(request, settings), '/admin')	4✔
28	const secure = isSecureRequest(request, settings) ? '; Secure' : ''	4✔
29
30	return `admin_session=${token}; Path=${cookiePath}; HttpOnly; SameSite=Strict; Max-Age=${maxAgeSeconds}${secure}`	4✔
31	}
32
33	export const buildAdminSessionClearCookieHeader = (request: IncomingMessage, settings: Settings): string => {	2✔
NEW 34	const cookiePath = joinPathPrefix(getPublicPathPrefix(request, settings), '/admin')	×
NEW 35	const secure = isSecureRequest(request, settings) ? '; Secure' : ''	×
36
NEW 37	return `admin_session=; Path=${cookiePath}; HttpOnly; SameSite=Strict; Max-Age=0${secure}`	×
38	}
39
40	export const createAdminSessionToken = (expiresAt: number): string => {	2✔
41	const signature = hmacSha256(deriveFromSecret('admin-session'), `${expiresAt}`).toString('hex')	4✔
42	return `${expiresAt}.${signature}`	3✔
43	}
44
45	export const parseAdminSessionToken = (token: string): { expiresAt: number } \| undefined => {	2✔
46	const separatorIndex = token.indexOf('.')	2✔
47	if (separatorIndex <= 0) {	2!
48	return undefined	×
49	}
50
51	const expiresAt = Number(token.slice(0, separatorIndex))	2✔
52	if (!Number.isFinite(expiresAt)) {	2!
53	return undefined	×
54	}
55
56	return { expiresAt }	2✔
57	}
58
59	export const isValidAdminSessionToken = (token: string, nowSeconds = Math.floor(Date.now() / 1000)): boolean => {	2✔
60	const separatorIndex = token.indexOf('.')	7✔
61	if (separatorIndex <= 0) {	7!
62	return false	×
63	}
64
65	const expiresAt = Number(token.slice(0, separatorIndex))	7✔
66	const signature = token.slice(separatorIndex + 1)	7✔
67
68	if (!Number.isFinite(expiresAt) \|\| expiresAt <= nowSeconds \|\| !/^[0-9a-f]+$/.test(signature)) {	7!
69	return false	×
70	}
71
72	const expected = hmacSha256(deriveFromSecret('admin-session'), `${expiresAt}`).toString('hex')	7✔
73	const expectedBuf = Buffer.from(expected, 'utf8')	6✔
74	const actualBuf = Buffer.from(signature, 'utf8')	6✔
75
76	if (expectedBuf.length !== actualBuf.length) {	6✔
77	return false	1✔
78	}
79
80	return timingSafeEqual(expectedBuf, actualBuf)	5✔
81	}
82
83	export const getAdminSessionTokenFromRequest = (authorizationHeader?: string, cookieHeader?: string): string \| undefined => {	2✔
84	if (authorizationHeader?.startsWith('Bearer ')) {	12✔
85	const token = authorizationHeader.slice('Bearer '.length).trim()	3✔
86	return token.length > 0 ? token : undefined	3!
87	}
88
89	if (!cookieHeader) {	9✔
90	return undefined	3✔
91	}
92
93	for (const part of cookieHeader.split(';')) {	6✔
94	const [name, ...valueParts] = part.trim().split('=')	6✔
95	if (name === 'admin_session') {	6!
96	const value = valueParts.join('=').trim()	6✔
97	return value.length > 0 ? value : undefined	6!
98	}
99	}
100
101	return undefined	×
102	}

cameri / nostream / 28783505715

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous