// Protected file listing (was the public root in the PHP version).
// Now mounted at /admin so the new public UI can live at /.
import { readdir, stat } from 'node:fs/promises';
import { join } from 'node:path';
import { ADMIN_PASSWORD_HASH, ROOT, TITLE } from '../config.js';
import { verifyPassword } from '../lib/password.js';
const HIDDEN = new Set([
'node_modules',
'package.json',
'package-lock.json',
'config.js',
'server.js',
'lib',
'routes',
'cron',
'tools',
'test',
'.git',
'.claude',
'.specstory',
'biome.json',
'public',
'.env',
'.env.example',
'.gitignore',
'README.md',
'.cron.lock',
]);
function esc(s) {
if (s == null) return '';
return String(s)
.replace(/&/g, '&')
.replace(//g, '>')
.replace(/"/g, '"')
.replace(/'/g, ''');
}
function formatBytes(bytes) {
const units = ['B', 'KB', 'MB', 'GB', 'TB', 'PB'];
let i = bytes > 0 ? Math.floor(Math.log(bytes) / Math.log(1024)) : 0;
if (i >= units.length) i = units.length - 1;
return `${bytes / 1024 ** i || 0} ${units[i]}`;
}
function pad(n) {
return n < 10 ? `0${n}` : String(n);
}
function fmtDate(ms) {
const d = new Date(ms);
return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())} ${pad(d.getHours())}:${pad(d.getMinutes())}`;
}
function loginPage(error = '') {
return `
Admin · ${esc(TITLE)}
`;
}
async function listingPage() {
const names = await readdir(ROOT);
const entries = [];
for (const name of names) {
if (HIDDEN.has(name)) continue;
if (name.startsWith('.')) continue;
let st;
try {
st = await stat(join(ROOT, name));
} catch {
continue;
}
entries.push({
name,
isDir: st.isDirectory(),
size: st.isFile() ? st.size : 0,
mtime: st.mtimeMs,
});
}
entries.sort((a, b) => {
if (a.isDir !== b.isDir) return a.isDir ? -1 : 1;
return a.name.toLowerCase().localeCompare(b.name.toLowerCase());
});
const rows = entries
.map((e) => {
const href = encodeURIComponent(e.name);
return `
| ${esc(e.name)}${e.isDir ? 'dossier' : ''} |
${e.isDir ? '—' : esc(formatBytes(e.size))} |
${esc(fmtDate(e.mtime))} |
`;
})
.join('');
return `
Admin · ${esc(TITLE)}
`;
}
export default async function adminRoutes(fastify) {
fastify.get('/admin', async (req, reply) => {
reply.header('Content-Type', 'text/html; charset=utf-8');
if (req.query?.logout != null) {
req.session.delete();
return reply.redirect('/admin');
}
if (!req.session.get('auth_ok')) return loginPage();
return listingPage();
});
fastify.post('/admin', async (req, reply) => {
reply.header('Content-Type', 'text/html; charset=utf-8');
const submitted = req.body?.password ?? '';
const ok = await verifyPassword(ADMIN_PASSWORD_HASH, submitted);
if (ok) {
req.session.set('auth_ok', true);
return reply.redirect('/admin');
}
return loginPage('Mot de passe incorrect.');
});
}