Add OIDC dashboard auth (#1020)

src/lib/auth/dashboardSession.js

@@ -0,0 +1,54 @@
+import { SignJWT, jwtVerify } from "jose";
+
+const SECRET = new TextEncoder().encode(
+  process.env.JWT_SECRET || "9router-default-secret-change-me"
+);
+
+export function shouldUseSecureCookie(request) {
+  const forceSecureCookie = process.env.AUTH_COOKIE_SECURE === "true";
+  const forwardedProto = request?.headers?.get?.("x-forwarded-proto");
+  const isHttpsRequest = forwardedProto === "https";
+  return forceSecureCookie || isHttpsRequest;
+}
+
+export async function createDashboardAuthToken(claims = {}) {
+  return new SignJWT({ authenticated: true, ...claims })
+    .setProtectedHeader({ alg: "HS256" })
+    .setIssuedAt()
+    .setExpirationTime("24h")
+    .sign(SECRET);
+}
+
+export async function verifyDashboardAuthToken(token) {
+  if (!token) return false;
+  try {
+    await jwtVerify(token, SECRET);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function getDashboardAuthSession(token) {
+  if (!token) return null;
+  try {
+    const { payload } = await jwtVerify(token, SECRET);
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+export async function setDashboardAuthCookie(cookieStore, request, claims = {}) {
+  const token = await createDashboardAuthToken(claims);
+  cookieStore.set("auth_token", token, {
+    httpOnly: true,
+    secure: shouldUseSecureCookie(request),
+    sameSite: "lax",
+    path: "/",
+  });
+}
+
+export function clearDashboardAuthCookie(cookieStore) {
+  cookieStore.delete("auth_token");
+}