feat: add visual admin panel with page builder and settings editor
- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves
This commit is contained in:
ralksta
83
lib/admin/auth.ts
Normal file
83
lib/admin/auth.ts
Normal file
@@ -0,0 +1,83 @@
|
||||
/**
|
||||
* Admin authentication utilities.
|
||||
* Uses HMAC-signed session tokens stored in HttpOnly cookies.
|
||||
*/
|
||||
|
||||
import crypto from 'crypto';
|
||||
import { env } from '../env';
|
||||
import { cookies } from 'next/headers';
|
||||
|
||||
const COOKIE_NAME = 'folio_admin_session';
|
||||
const SESSION_DURATION_MS = 24 * 60 * 60 * 1000; // 24 hours
|
||||
|
||||
function getSigningKey(): Buffer {
|
||||
const secret = env.AUTH_SECRET || 'dev-fallback-secret';
|
||||
return crypto.createHash('sha256').update(`admin:${secret}`).digest();
|
||||
}
|
||||
|
||||
/** Create a signed session token. */
|
||||
export function createAdminToken(): string {
|
||||
const payload = {
|
||||
role: 'admin',
|
||||
iat: Date.now(),
|
||||
exp: Date.now() + SESSION_DURATION_MS,
|
||||
};
|
||||
const data = Buffer.from(JSON.stringify(payload)).toString('base64url');
|
||||
const key = getSigningKey();
|
||||
const sig = crypto.createHmac('sha256', key).update(data).digest('base64url');
|
||||
return `${data}.${sig}`;
|
||||
}
|
||||
|
||||
/** Verify a session token. Returns true if valid. */
|
||||
export function verifyAdminToken(token: string): boolean {
|
||||
const parts = token.split('.');
|
||||
if (parts.length !== 2) return false;
|
||||
|
||||
const [data, sig] = parts;
|
||||
const key = getSigningKey();
|
||||
const expectedSig = crypto.createHmac('sha256', key).update(data).digest('base64url');
|
||||
|
||||
if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expectedSig))) {
|
||||
return false;
|
||||
}
|
||||
|
||||
try {
|
||||
const payload = JSON.parse(Buffer.from(data, 'base64url').toString());
|
||||
if (payload.role !== 'admin') return false;
|
||||
if (typeof payload.exp !== 'number' || payload.exp < Date.now()) return false;
|
||||
return true;
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
/** Verify admin password. */
|
||||
export function verifyAdminPassword(password: string): boolean {
|
||||
const adminPw = env.ADMIN_PASSWORD;
|
||||
if (!adminPw) return false;
|
||||
|
||||
// Constant-time comparison
|
||||
const pwBuf = Buffer.from(password);
|
||||
const expectedBuf = Buffer.from(adminPw);
|
||||
if (pwBuf.length !== expectedBuf.length) {
|
||||
// Still do a comparison to prevent timing attacks on length
|
||||
crypto.timingSafeEqual(pwBuf, Buffer.alloc(pwBuf.length));
|
||||
return false;
|
||||
}
|
||||
return crypto.timingSafeEqual(pwBuf, expectedBuf);
|
||||
}
|
||||
|
||||
/** Check if the current request has a valid admin session. */
|
||||
export async function isAdminAuthenticated(): Promise<boolean> {
|
||||
const cookieStore = await cookies();
|
||||
const token = cookieStore.get(COOKIE_NAME)?.value;
|
||||
if (!token) return false;
|
||||
return verifyAdminToken(token);
|
||||
}
|
||||
|
||||
/** Check if admin panel is enabled (password is set). */
|
||||
export function isAdminEnabled(): boolean {
|
||||
return !!env.ADMIN_PASSWORD;
|
||||
}
|
||||
|
||||
export { COOKIE_NAME, SESSION_DURATION_MS };
|
||||
148
lib/admin/yaml-service.ts
Normal file
148
lib/admin/yaml-service.ts
Normal file
@@ -0,0 +1,148 @@
|
||||
/**
|
||||
* YAML read/write service for the admin panel.
|
||||
* Handles atomic writes with automatic backup creation.
|
||||
*/
|
||||
|
||||
import fs from 'fs/promises';
|
||||
import path from 'path';
|
||||
import yaml from 'js-yaml';
|
||||
import type { GalleryYaml, SettingsYaml } from '../config/schema';
|
||||
|
||||
const CONTENT_DIR = path.join(process.cwd(), 'content');
|
||||
const MAX_BACKUPS = 10; // Keep last 10 backups per file
|
||||
|
||||
/** Read gallery.yaml and return parsed content. */
|
||||
export async function readGalleryYaml(): Promise<GalleryYaml | null> {
|
||||
try {
|
||||
const raw = await fs.readFile(path.join(CONTENT_DIR, 'gallery.yaml'), 'utf8');
|
||||
return yaml.load(raw) as GalleryYaml;
|
||||
} catch (err) {
|
||||
if ((err as NodeJS.ErrnoException).code === 'ENOENT') return null;
|
||||
throw err;
|
||||
}
|
||||
}
|
||||
|
||||
/** Read settings.yaml and return parsed content. */
|
||||
export async function readSettingsYaml(): Promise<SettingsYaml | null> {
|
||||
try {
|
||||
const raw = await fs.readFile(path.join(CONTENT_DIR, 'settings.yaml'), 'utf8');
|
||||
return yaml.load(raw) as SettingsYaml;
|
||||
} catch (err) {
|
||||
if ((err as NodeJS.ErrnoException).code === 'ENOENT') return null;
|
||||
throw err;
|
||||
}
|
||||
}
|
||||
|
||||
/** Atomically write a YAML file with backup. */
|
||||
async function writeYamlFile(filename: string, data: unknown): Promise<void> {
|
||||
const filePath = path.join(CONTENT_DIR, filename);
|
||||
|
||||
// Ensure content directory exists
|
||||
await fs.mkdir(CONTENT_DIR, { recursive: true });
|
||||
|
||||
// Create backup if file exists
|
||||
try {
|
||||
await fs.access(filePath);
|
||||
const backupDir = path.join(CONTENT_DIR, '.backups');
|
||||
await fs.mkdir(backupDir, { recursive: true });
|
||||
|
||||
const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
|
||||
const backupName = `${filename}.${timestamp}.bak`;
|
||||
await fs.copyFile(filePath, path.join(backupDir, backupName));
|
||||
|
||||
// Prune old backups
|
||||
await pruneBackups(backupDir, filename);
|
||||
} catch {
|
||||
// File doesn't exist yet, no backup needed
|
||||
}
|
||||
|
||||
// Generate YAML content with header comment
|
||||
const header =
|
||||
filename === 'gallery.yaml'
|
||||
? '# ── Gallery Structure (managed by Immich Folio Admin) ──────────────\n'
|
||||
: '# ── Site Settings (managed by Immich Folio Admin) ─────────────────\n';
|
||||
|
||||
const content =
|
||||
header +
|
||||
yaml.dump(data, {
|
||||
lineWidth: 120,
|
||||
quotingType: '"',
|
||||
noRefs: true,
|
||||
sortKeys: false,
|
||||
});
|
||||
|
||||
// Atomic write: write to temp file, then rename
|
||||
const tmpPath = `${filePath}.tmp`;
|
||||
await fs.writeFile(tmpPath, content, 'utf8');
|
||||
await fs.rename(tmpPath, filePath);
|
||||
|
||||
console.log(`[Admin] ✅ Saved ${filename}`);
|
||||
}
|
||||
|
||||
/** Write gallery.yaml. */
|
||||
export async function writeGalleryYaml(data: GalleryYaml): Promise<void> {
|
||||
await writeYamlFile('gallery.yaml', data);
|
||||
}
|
||||
|
||||
/** Write settings.yaml. */
|
||||
export async function writeSettingsYaml(data: SettingsYaml): Promise<void> {
|
||||
await writeYamlFile('settings.yaml', data);
|
||||
}
|
||||
|
||||
/** List available backups for a file. */
|
||||
export async function listBackups(filename: string): Promise<string[]> {
|
||||
const backupDir = path.join(CONTENT_DIR, '.backups');
|
||||
try {
|
||||
const files = await fs.readdir(backupDir);
|
||||
return files
|
||||
.filter((f) => f.startsWith(filename))
|
||||
.sort()
|
||||
.reverse();
|
||||
} catch {
|
||||
return [];
|
||||
}
|
||||
}
|
||||
|
||||
/** Restore a specific backup. */
|
||||
export async function restoreBackup(backupFilename: string): Promise<void> {
|
||||
const backupDir = path.join(CONTENT_DIR, '.backups');
|
||||
const backupPath = path.join(backupDir, backupFilename);
|
||||
|
||||
// Determine the original filename
|
||||
const originalFilename = backupFilename.includes('gallery.yaml')
|
||||
? 'gallery.yaml'
|
||||
: 'settings.yaml';
|
||||
|
||||
const targetPath = path.join(CONTENT_DIR, originalFilename);
|
||||
|
||||
// Create a backup of current state first
|
||||
const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
|
||||
const preRestoreBackup = `${originalFilename}.${timestamp}.pre-restore.bak`;
|
||||
try {
|
||||
await fs.copyFile(targetPath, path.join(backupDir, preRestoreBackup));
|
||||
} catch {
|
||||
// Original might not exist
|
||||
}
|
||||
|
||||
await fs.copyFile(backupPath, targetPath);
|
||||
console.log(`[Admin] 🔄 Restored ${originalFilename} from ${backupFilename}`);
|
||||
}
|
||||
|
||||
/** Remove old backups, keeping only MAX_BACKUPS most recent. */
|
||||
async function pruneBackups(backupDir: string, filename: string): Promise<void> {
|
||||
try {
|
||||
const files = await fs.readdir(backupDir);
|
||||
const relevant = files
|
||||
.filter((f) => f.startsWith(filename) && !f.includes('pre-restore'))
|
||||
.sort();
|
||||
|
||||
if (relevant.length > MAX_BACKUPS) {
|
||||
const toDelete = relevant.slice(0, relevant.length - MAX_BACKUPS);
|
||||
for (const f of toDelete) {
|
||||
await fs.unlink(path.join(backupDir, f));
|
||||
}
|
||||
}
|
||||
} catch {
|
||||
// Ignore errors during pruning
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user