Release 0.2.0

src/hooks.server.ts

@@ -0,0 +1,32 @@
+import { redirect } from '@sveltejs/kit';
+import type { Handle } from '@sveltejs/kit/hooks';
+import { deleteSession, getSessionUser, hasUsers, SESSION_COOKIE } from '#lib/server/auth.js';
+
+const publicPaths = new Set([
+	'/',
+	'/healthz',
+	'/login',
+	'/setup',
+	'/einladung',
+	'/passwort-vergessen',
+	'/passwort-zuruecksetzen'
+]);
+
+export const handle: Handle = async ({ event, resolve }) => {
+	const token = event.cookies.get(SESSION_COOKIE);
+	event.locals.user = getSessionUser(token);
+	if (token && !event.locals.user) deleteSession(event.cookies);
+
+	if (!publicPaths.has(event.url.pathname) && !event.locals.user) {
+		redirect(303, hasUsers() ? '/login' : '/setup');
+	}
+
+	const response = await resolve(event);
+	response.headers.set('Referrer-Policy', 'same-origin');
+	response.headers.set('X-Content-Type-Options', 'nosniff');
+	response.headers.set('X-Frame-Options', 'DENY');
+	if (event.url.pathname === '/einladung' || event.url.pathname === '/passwort-zuruecksetzen') {
+		response.headers.set('Cache-Control', 'no-store');
+	}
+	return response;
+};