Initial commit: KOC LOOP platform

lib/admin-auth.ts

@@ -0,0 +1,35 @@
+import { env } from "cloudflare:workers";
+
+export function isAdminEmail(input: string | null | undefined) {
+  const allowedEmail = String(
+    (env as unknown as { ADMIN_ALLOWED_EMAIL?: string }).ADMIN_ALLOWED_EMAIL ??
+      "",
+  )
+    .trim()
+    .toLowerCase();
+  const requestEmail = String(input ?? "").trim().toLowerCase();
+  return Boolean(allowedEmail && requestEmail && requestEmail === allowedEmail);
+}
+
+export function isAdminRequest(request: Request) {
+  if (isAdminEmail(request.headers.get("oai-authenticated-user-email"))) {
+    return true;
+  }
+  const expectedToken = String(
+    (env as unknown as { ADMIN_INTERNAL_TOKEN?: string }).ADMIN_INTERNAL_TOKEN ??
+      "",
+  ).trim();
+  const requestToken = String(
+    request.headers.get("x-koc-admin-token") ?? "",
+  ).trim();
+  return Boolean(
+    expectedToken &&
+      requestToken &&
+      expectedToken.length === requestToken.length &&
+      expectedToken === requestToken,
+  );
+}
+
+export function adminForbidden() {
+  return Response.json({ error: "无后台操作权限" }, { status: 403 });
+}