spb/satelliteindex

1import { NextResponse } from 'next/server';2import { ADMIN_COOKIE, cookieOptions, hashToken, safeNextPath, verifyToken } from '@/lib/admin-auth';34export const dynamic = 'force-dynamic';56/** Login form target: compares the posted token with SI_ADMIN_TOKEN server-side and sets the httpOnly session cookie. */7export async function POST(req: Request): Promise<Response> {8  const form = await req.formData().catch(() => null);9  const token = typeof form?.get('token') === 'string' ? String(form.get('token')).trim() : '';10  const next = safeNextPath(typeof form?.get('next') === 'string' ? String(form.get('next')) : null);11  if (!verifyToken(token)) {12    const url = new URL('/admin/login', req.url);13    url.searchParams.set('error', process.env.SI_ADMIN_TOKEN ? 'invalid' : 'unconfigured');14    if (next !== '/admin') url.searchParams.set('next', next);15    return NextResponse.redirect(url, 303);16  }17  const res = NextResponse.redirect(new URL(next, req.url), 303);18  res.cookies.set(ADMIN_COOKIE, hashToken(token), cookieOptions());19  return res;20}21