Initial Commit

Author: wearrrrr

.gitignore

@@ -0,0 +1,2 @@
+node_modules/
+dist/

package.json

@@ -0,0 +1,16 @@
+{
+  "name": "masqr-express",
+  "version": "1.0.0",
+  "main": "index.js",
+  "scripts": {
+    "build": "tsc"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "description": "",
+  "dependencies": {
+    "@types/express": "^4.17.21",
+    "@types/node": "^20.14.12"
+  }
+}

pnpm-lock.yaml

@@ -0,0 +1,63 @@
+import path from "path";
+import fs from "fs";
+import type { Request, Response, NextFunction } from "express";
+
+type MasqrConfig = {
+  licenseServer: string;
+  whitelist: string[];
+}
+
+export async function masqrCheck(config: MasqrConfig, htmlFile: string): Promise<Function> {
+  let loadedHTMLFile = fs.readFileSync(htmlFile, "utf8");
+  return async (req: Request, res: Response, next: NextFunction) => {
+    if (req.headers.host && config.whitelist.includes(req.headers.host)) {
+      next();
+      return;
+    }
+    const authheader = req.headers.authorization;
+    if (req.cookies["authcheck"]) {
+      next();
+      return;
+    }
+    if (!authheader) {
+      res.setHeader("WWW-Authenticate", "Basic");
+      res.status(401);
+      MasqFail(req, res, loadedHTMLFile);
+      return;
+    }
+    // If we are at this point, then the request should be a valid masqr request, and we are going to check the license server
+    const auth = Buffer.from(authheader.split(" ")[1], "base64").toString().split(":");
+    const pass = auth[1];
+
+    const licenseCheck = (await (await fetch(config.licenseServer + pass + "&host=" + req.headers.host)).json())["status"];
+
+    if (licenseCheck === "License valid") {
+      // Authenticated, set cookie for a year
+      res.cookie("authcheck", "true", {
+        expires: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000),
+      });
+      res.send(`<script>window.location.href = window.location.href</script>`); // fun hack to make the browser refresh and remove the auth params from the URL
+      return;
+    }
+  }
+}
+
+async function MasqFail(req: Request, res: Response, failureFile: string) {
+  if (!req.headers.host) {
+    return;
+  }
+  const unsafeSuffix = req.headers.host + ".html";
+  let safeSuffix = path.normalize(unsafeSuffix).replace(/^(\.\.(\/|\\|$))+/, "");
+  let safeJoin = path.join(process.cwd() + "/Masqrd", safeSuffix);
+  try {
+    await fs.promises.access(safeJoin); // man do I wish this was an if-then instead of a "exception on fail"
+    const failureFileLocal = await fs.promises.readFile(safeJoin, "utf8");
+    res.setHeader("Content-Type", "text/html");
+    res.send(failureFileLocal);
+    return;
+  } catch (e) {
+    res.setHeader("Content-Type", "text/html");
+    res.send(failureFile);
+    return;
+  }
+}

src/masqr.ts

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "ES2020",
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true,
+    "strict": true,
+    "skipLibCheck": true,
+    "rootDir": "src",
+    "outDir": "dist",
+    "moduleResolution": "Node",
+    "declaration": true,
+  }
+}