104 lines
3.1 KiB
TypeScript
104 lines
3.1 KiB
TypeScript
import { createAdminClient } from "npm:@insforge/sdk";
|
|
|
|
const corsHeaders = {
|
|
"Access-Control-Allow-Origin": "*",
|
|
"Access-Control-Allow-Methods": "POST, OPTIONS",
|
|
"Access-Control-Allow-Headers": "Content-Type, Authorization",
|
|
};
|
|
|
|
function sha256Hex(text: string): Promise<string> {
|
|
return crypto.subtle
|
|
.digest("SHA-256", new TextEncoder().encode(text))
|
|
.then((buf) =>
|
|
Array.from(new Uint8Array(buf))
|
|
.map((b) => b.toString(16).padStart(2, "0"))
|
|
.join("")
|
|
);
|
|
}
|
|
|
|
export default async function (req: Request): Promise<Response> {
|
|
if (req.method === "OPTIONS") {
|
|
return new Response(null, { status: 204, headers: corsHeaders });
|
|
}
|
|
if (req.method !== "POST") {
|
|
return new Response(JSON.stringify({ error: "Method not allowed" }), {
|
|
status: 405,
|
|
headers: { ...corsHeaders, "Content-Type": "application/json" },
|
|
});
|
|
}
|
|
|
|
try {
|
|
const { username, token, data } = await req.json();
|
|
|
|
if (
|
|
typeof username !== "string" ||
|
|
typeof token !== "string" ||
|
|
!username.trim() ||
|
|
!token
|
|
) {
|
|
return new Response(JSON.stringify({ error: "Sesi admin tidak valid." }), {
|
|
status: 401,
|
|
headers: { ...corsHeaders, "Content-Type": "application/json" },
|
|
});
|
|
}
|
|
|
|
const admin = createAdminClient({
|
|
baseUrl: Deno.env.get("INSFORGE_BASE_URL")!,
|
|
apiKey: Deno.env.get("INSFORGE_API_KEY")!,
|
|
});
|
|
|
|
const { data: user } = await admin.database
|
|
.from("app_users")
|
|
.select("username")
|
|
.eq("username", username.trim())
|
|
.eq("approved", true)
|
|
.maybeSingle();
|
|
|
|
if (!user) {
|
|
return new Response(
|
|
JSON.stringify({ error: "Hanya admin yang disetujui boleh menyimpan." }),
|
|
{ status: 403, headers: { ...corsHeaders, "Content-Type": "application/json" } }
|
|
);
|
|
}
|
|
|
|
const pepper = Deno.env.get("AUTH_PEPPER") ?? "";
|
|
const expected = await sha256Hex(`${username.trim()}|${pepper}`);
|
|
if (expected !== token) {
|
|
return new Response(JSON.stringify({ error: "Token tidak valid." }), {
|
|
status: 403,
|
|
headers: { ...corsHeaders, "Content-Type": "application/json" },
|
|
});
|
|
}
|
|
|
|
if (!data || typeof data !== "object") {
|
|
return new Response(JSON.stringify({ error: "Data tidak valid." }), {
|
|
status: 400,
|
|
headers: { ...corsHeaders, "Content-Type": "application/json" },
|
|
});
|
|
}
|
|
|
|
const { error } = await admin.database.from("site_data").upsert({
|
|
id: "main",
|
|
data,
|
|
updated_at: new Date().toISOString(),
|
|
});
|
|
|
|
if (error) {
|
|
return new Response(JSON.stringify({ error: error.message }), {
|
|
status: 500,
|
|
headers: { ...corsHeaders, "Content-Type": "application/json" },
|
|
});
|
|
}
|
|
|
|
return new Response(JSON.stringify({ ok: true }), {
|
|
status: 200,
|
|
headers: { ...corsHeaders, "Content-Type": "application/json" },
|
|
});
|
|
} catch (err) {
|
|
return new Response(
|
|
JSON.stringify({ error: err instanceof Error ? err.message : "Unknown error" }),
|
|
{ status: 500, headers: { ...corsHeaders, "Content-Type": "application/json" } }
|
|
);
|
|
}
|
|
}
|