Something went wrong. Try again.
[READ-ONLY] Mirror of https://github.com/openstatusHQ/openstatus. 🫖 Status page with uptime monitoring & API monitoring as code 🫖 openstatus.dev
bun drizzle-orm monitoring monitoring-as-code nextjs observability on-call open-source shadcn-ui status-page statuspage synthetic-monitoring tinybird turso uptime uptime-checker uptime-monitor
Something went wrong. Try again.
1.6 kB · 48 lines
TypeScript
at main
12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849import type { Page } from "@openstatus/db/src/schema";
import { isEmailDomainAuthorized, isIpAuthorized } from "./access-predicates";
export type MarkdownGateResult = | { ok: true } | { ok: false; status: 401 | 403; body: string };
/** * Pure access-control decision for a markdown request, mirroring the proxy gate * chain. Security-critical: the markdown route is reachable directly via `/api`, * which bypasses the proxy, so this is the only enforcement on that path. * * `passwordAuthorized` is resolved server-side (via `statusPage.isPasswordAuthorized`) * so the stored password never reaches this surface. */export function evaluateMarkdownGate(input: { accessType: Page["accessType"]; passwordAuthorized: boolean; authEmail: string | null | undefined; authEmailDomains: string[] | null; clientIp: string | null | undefined; allowedIpRanges: string[] | null;}): MarkdownGateResult { switch (input.accessType) { case "public": return { ok: true };
case "password": return input.passwordAuthorized ? { ok: true } : { ok: false, status: 401, body: "Unauthorized" };
case "email-domain": return isEmailDomainAuthorized(input.authEmail, input.authEmailDomains) ? { ok: true } : { ok: false, status: 403, body: "Forbidden" };
case "ip-restriction": return isIpAuthorized(input.clientIp, input.allowedIpRanges) ? { ok: true } : { ok: false, status: 403, body: "Forbidden" };
default: // Unknown access type → deny. return { ok: false, status: 403, body: "Forbidden" }; }}