mirror of
https://github.com/DayuanJiang/next-ai-draw-io.git
synced 2026-09-02 01:20:23 +08:00
e4a14c3628
Replace the provider credential fields and raw AI_MODELS_CONFIG JSON textarea with a Models section mirroring the in-app model settings UI: provider instance list with logos, credential fields per provider type, model add/remove with suggestions, per-model connectivity test, and a default-provider star. On save the server derives everything the runtime needs into settings.json: credential env vars (with _2 suffixes for multiple instances of one provider), AI_MODELS_CONFIG, and AI_PROVIDER/AI_MODEL for the default. Secrets round-trip as masked markers and are never sent back to the browser. The general settings registry now only covers non-provider settings (generation, access, features, observability, quota).
38 lines
1.1 KiB
TypeScript
38 lines
1.1 KiB
TypeScript
import { timingSafeEqual } from "crypto"
|
|
|
|
// Shared auth for admin API routes: compares x-admin-password header
|
|
// against the ADMIN_PASSWORD env var. Unset password = panel disabled.
|
|
export function checkAdminAuth(req: Request): Response | null {
|
|
const password = process.env.ADMIN_PASSWORD
|
|
if (!password) {
|
|
return Response.json(
|
|
{
|
|
error: "Admin panel is disabled. Set the ADMIN_PASSWORD environment variable to enable it.",
|
|
},
|
|
{ status: 403 },
|
|
)
|
|
}
|
|
const provided = req.headers.get("x-admin-password") || ""
|
|
const a = Buffer.from(provided)
|
|
const b = Buffer.from(password)
|
|
if (a.length !== b.length || !timingSafeEqual(a, b)) {
|
|
return Response.json(
|
|
{ error: "Invalid admin password" },
|
|
{ status: 401 },
|
|
)
|
|
}
|
|
return null
|
|
}
|
|
|
|
export interface MaskedSecret {
|
|
isSet: true
|
|
hint: string
|
|
}
|
|
|
|
export function maskSecret(value: string): MaskedSecret {
|
|
return {
|
|
isSet: true,
|
|
hint: value.length > 8 ? `…${value.slice(-4)}` : "••••",
|
|
}
|
|
}
|