export const SESSION_COOKIE_NAME = "__Host-awp_session"; export const INTERNAL_SESSION_HEADER = "x-awp-session"; export function sessionFromCookie(cookieHeader: string | undefined): string | undefined { if (!cookieHeader) return undefined; for (const part of cookieHeader.split(";")) { const [name, ...rest] = part.trim().split("="); if (name === SESSION_COOKIE_NAME) { const value = rest.join("=").trim(); return value || undefined; } } return undefined; } export function setSessionCookie(token: string): string { return `${SESSION_COOKIE_NAME}=${token}; Path=/; HttpOnly; Secure; SameSite=Lax`; } export function clearSessionCookie(): string { return `${SESSION_COOKIE_NAME}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT`; } export function internalSessionHeaders( token: string, contentType?: string, ): Record { return { [INTERNAL_SESSION_HEADER]: token, ...(contentType ? { "content-type": contentType } : {}), }; } export function mutationIsCrossSite(input: { readonly method?: string; readonly origin?: string; readonly secFetchSite?: string; readonly host?: string; }): boolean { const method = (input.method ?? "GET").toUpperCase(); if (method === "GET" || method === "HEAD" || method === "OPTIONS") return false; if (input.secFetchSite?.toLowerCase() === "cross-site") return true; if (!input.origin) return false; try { return new URL(input.origin).host !== input.host; } catch { return true; } } export class LoginRateLimiter { private readonly attempts = new Map(); constructor( private readonly maxAttempts = 5, private readonly windowMs = 60_000, private readonly now: () => number = Date.now, ) {} allow(key: string): boolean { const now = this.now(); const current = this.attempts.get(key); if (!current || now - current.windowStartedAt >= this.windowMs) { this.attempts.set(key, { count: 1, windowStartedAt: now }); return true; } if (current.count >= this.maxAttempts) return false; current.count += 1; return true; } reset(key: string): void { this.attempts.delete(key); } } export function loginPage(error?: string): string { const message = error ? `

${escapeHtml(error)}

` : ""; return `Sign in — AWP

AWP operator

${message}
`; } function escapeHtml(value: string): string { return value.replace( /[&<>"']/g, (character) => ({ "&": "&", "<": "<", ">": ">", '"': """, "'": "'", })[character] ?? character, ); }