Sergei Poljanski
c7fe108ecf
start_with?('/admin') also matched /admin-invoice-form.js, returning 401
for the public JS asset that the New Invoice form depends on. Without it,
the "+ add line" button did nothing.
Require either the bare /admin path or a /admin/-prefixed one so sibling
assets in public/ that happen to share the prefix stay reachable.
25 lines
756 B
Ruby
25 lines
756 B
Ruby
require 'rack/auth/basic'
|
|
|
|
# Rack middleware that gates everything under /admin/* behind HTTP Basic.
|
|
# Credentials come from ENV at boot; missing vars fail closed (401 always).
|
|
class AdminAuth
|
|
def initialize(app)
|
|
@app = app
|
|
@user = ENV['ADMIN_USER']
|
|
@pass = ENV['ADMIN_PASSWORD']
|
|
end
|
|
|
|
def call(env)
|
|
path = env['PATH_INFO'].to_s
|
|
return @app.call(env) unless path == '/admin' || path.start_with?('/admin/')
|
|
|
|
auth = Rack::Auth::Basic::Request.new(env)
|
|
if @user && @pass && auth.provided? && auth.basic? && auth.credentials == [@user, @pass]
|
|
@app.call(env)
|
|
else
|
|
[401,
|
|
{ 'content-type' => 'text/plain', 'www-authenticate' => 'Basic realm="asxp.io admin"' },
|
|
["Unauthorized\n"]]
|
|
end
|
|
end
|
|
end
|