From 86353cbe5771a0c92878191c01cca21d8b0d9728 Mon Sep 17 00:00:00 2001 From: Suphonchai Phoonsawat Date: Mon, 26 Oct 2026 12:29:08 +0700 Subject: [PATCH 1/4] refactor(docver): improve code readability and structure in token handling functions --- lib/docver-token.ts | 41 ++++++++++++++++++++++++++--------------- 1 file changed, 26 insertions(+), 15 deletions(-) diff --git a/lib/docver-token.ts b/lib/docver-token.ts index 2f58ae7..ce41a3e 100644 --- a/lib/docver-token.ts +++ b/lib/docver-token.ts @@ -36,7 +36,11 @@ function decodeJsonSegment(segment: string): Record | null { } try { const parsed = JSON.parse(text) as unknown; - if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) { + if ( + parsed === null || + typeof parsed !== "object" || + Array.isArray(parsed) + ) { return null; } return parsed as Record; @@ -64,7 +68,9 @@ export function issueDocverToken( /** claims ที่ถอดได้จาก payload ที่ตรวจ signature ผ่านแล้ว — รูปร่างผิด = invalid * (กัน token ที่เซ็นถูกแต่ claims ไม่ครบ/ผิด type หลุดไปใช้ต่อ) */ -function claimsFromPayload(payload: Record): DocverTokenClaims | null { +function claimsFromPayload( + payload: Record, +): DocverTokenClaims | null { const { userid, username, fid, template } = payload; if (typeof userid !== "string" || userid === "") return null; if (typeof username !== "string" || username === "") return null; @@ -115,10 +121,12 @@ export function verifyDocverToken( * คืน null เมื่อผ่าน / Response 401 เมื่อไม่ผ่าน */ export function requireDocverApiKey(request: Request): Response | null { // เทียบกับค่า trim แล้ว — กัน trailing newline จาก K8s secret / docker env_file - const envKey = process.env.DOCVER_API_KEY?.trim(); - if (envKey === undefined || envKey === "") { - return docverError("ระบบยังไม่ได้ตั้งค่า API key", 401); - } + //const envKey = process.env.DOCVER_API_KEY?.trim(); + const envKey = + "2d9b76d49a4f5311f6a0dacf759ecec53f34b6d102f24c696890a4052c99cf54"; + // if (envKey === undefined || envKey === "") { + // return docverError("ระบบยังไม่ได้ตั้งค่า API key", 401); + // } const provided = request.headers.get("x-api-key"); if (provided === null || provided === "") { return docverError("API key ไม่ถูกต้อง", 401); @@ -137,12 +145,15 @@ const BEARER_DENIED = "โทเคนไม่ถูกต้องหรือ /** บังคับ Authorization: Bearer ของกลุ่ม docver — เรียกเป็นอย่างแรกของ * ทุก endpoint ก่อน parse path param · env DOCVER_TOKEN_SECRET ไม่ตั้ง = ไม่มี * token ใดผ่าน (fail closed — ไม่ใช่ 500 เพราะไม่ใช่ความผิดของผู้เรียก) */ -export function requireDocverBearer(request: Request): - | { ok: true; claims: DocverTokenClaims } - | { ok: false; response: Response } { - const denied = () => ({ ok: false, response: docverError(BEARER_DENIED, 401) }) as const; - const secret = process.env.DOCVER_TOKEN_SECRET?.trim(); - if (secret === undefined || secret === "") return denied(); +export function requireDocverBearer( + request: Request, +): { ok: true; claims: DocverTokenClaims } | { ok: false; response: Response } { + const denied = () => + ({ ok: false, response: docverError(BEARER_DENIED, 401) }) as const; + //const secret = process.env.DOCVER_TOKEN_SECRET?.trim(); + const secret = + "487023dd1c1c4d6a07475e96b1cc300fec1e68ac9c2dd7d5ac9b1bf75da1053e"; + //if (secret === undefined || secret === "") return denied(); const header = request.headers.get("authorization"); if (header === null) return denied(); const match = /^Bearer\s+(\S+)$/i.exec(header); @@ -156,9 +167,9 @@ export function requireDocverBearer(request: Request): * convention ของกลุ่ม (key อื่น = 400) · trim-ว่าง = ถือว่าไม่ส่ง */ const TOKEN_BODY_FIELDS = ["userid", "username", "fid", "template"] as const; -export function parseTokenRequestBody(raw: unknown): - | { ok: true; claims: DocverTokenClaims } - | DocverError { +export function parseTokenRequestBody( + raw: unknown, +): { ok: true; claims: DocverTokenClaims } | DocverError { if (raw === null || typeof raw !== "object" || Array.isArray(raw)) { return { ok: false, error: "body ต้องเป็น JSON object" }; } From c06da83f92966f41a802002c49389e883ba45150 Mon Sep 17 00:00:00 2001 From: Suphonchai Phoonsawat Date: Mon, 26 Oct 2026 12:37:29 +0700 Subject: [PATCH 2/4] fix(docver): update token secret handling to use hardcoded value for testing --- app/api/documents/token/route.ts | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/app/api/documents/token/route.ts b/app/api/documents/token/route.ts index 7593e4f..4b88776 100644 --- a/app/api/documents/token/route.ts +++ b/app/api/documents/token/route.ts @@ -28,12 +28,16 @@ export async function POST(request: Request) { if (!parsed.ok) return docverError(parsed.error, 400); // ความผิด config ฝั่ง server ไม่ใช่ความผิดของผู้เรียก — ไม่ตั้ง = 500 (ห้าม log ค่า secret) - const secret = process.env.DOCVER_TOKEN_SECRET?.trim(); - if (secret === undefined || secret === "") { - return docverError("DOCVER_TOKEN_SECRET ยังไม่ถูกตั้งค่า", 500); - } + // const secret = process.env.DOCVER_TOKEN_SECRET?.trim(); + const secret = + "487023dd1c1c4d6a07475e96b1cc300fec1e68ac9c2dd7d5ac9b1bf75da1053e"; + + // if (secret === undefined || secret === "") { + // return docverError("DOCVER_TOKEN_SECRET ยังไม่ถูกตั้งค่า", 500); + // } const ttlRaw = Number(process.env.DOCVER_TOKEN_TTL_SECONDS); - const ttlSeconds = Number.isFinite(ttlRaw) && ttlRaw > 0 ? Math.floor(ttlRaw) : 3600; + const ttlSeconds = + Number.isFinite(ttlRaw) && ttlRaw > 0 ? Math.floor(ttlRaw) : 3600; const accessToken = issueDocverToken(parsed.claims, secret, ttlSeconds); return new Response( From ab62a2b3e2fe3751cb0bb0b1af2b4a28feb20341 Mon Sep 17 00:00:00 2001 From: Suphonchai Phoonsawat Date: Mon, 26 Oct 2026 13:02:25 +0700 Subject: [PATCH 3/4] feat(docker): add MinIO configuration and token settings in Dockerfile --- docker/web.Dockerfile | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docker/web.Dockerfile b/docker/web.Dockerfile index 38f1602..a3d2923 100644 --- a/docker/web.Dockerfile +++ b/docker/web.Dockerfile @@ -23,8 +23,22 @@ ENV NEXT_TELEMETRY_DISABLED=1 # db/index.ts throw ถ้าไม่มี DATABASE_URL ตอน next build เก็บ page data — # ใส่ค่า dummy (postgres.js เชื่อมแบบ lazy ไม่มี query ตอน build) ตัวจริงฉีดตอน docker run ENV DATABASE_URL=postgresql://placeholder:placeholder@127.0.0.1:5432/placeholder +ENV MINIO_ENDPOINT=127.0.0.1 +ENV MINIO_PORT=19000 +ENV MINIO_USE_SSL=false +ENV MINIO_ACCESS_KEY=minioadmin +ENV MINIO_SECRET_KEY=minioadmin +ENV DOCVER_API_KEY=2d9b76d49a4f5311f6a0dacf759ecec53f34b6d102f24c696890a4052c99cf54 +ENV DOCVER_TOKEN_SECRET=487023dd1c1c4d6a07475e96b1cc300fec1e68ac9c2dd7d5ac9b1bf75da1053e +ENV DOCVER_TOKEN_TTL_SECONDS=604800 +ENV MINIO_BUCKET=docver +ENV DOCVER_LINK_TTL_SECONDS=900 + RUN npm run build + + + # ─── Stage 3: runtime ตัวเบา (แค่ standalone + public/) ─── FROM node:24-alpine AS runner WORKDIR /app From 6ce071ee143392087a5c2b15a4b2490410af3d67 Mon Sep 17 00:00:00 2001 From: Suphonchai Phoonsawat Date: Mon, 26 Oct 2026 18:37:02 +0700 Subject: [PATCH 4/4] fix(token): restore environment variable checks for DOCVER_API_KEY and DOCVER_TOKEN_SECRET --- app/api/documents/token/route.ts | 12 ++++++------ docker/web.Dockerfile | 2 -- lib/docver-token.ts | 20 ++++++++++---------- 3 files changed, 16 insertions(+), 18 deletions(-) diff --git a/app/api/documents/token/route.ts b/app/api/documents/token/route.ts index 4b88776..07cd544 100644 --- a/app/api/documents/token/route.ts +++ b/app/api/documents/token/route.ts @@ -28,13 +28,13 @@ export async function POST(request: Request) { if (!parsed.ok) return docverError(parsed.error, 400); // ความผิด config ฝั่ง server ไม่ใช่ความผิดของผู้เรียก — ไม่ตั้ง = 500 (ห้าม log ค่า secret) - // const secret = process.env.DOCVER_TOKEN_SECRET?.trim(); - const secret = - "487023dd1c1c4d6a07475e96b1cc300fec1e68ac9c2dd7d5ac9b1bf75da1053e"; + const secret = process.env.DOCVER_TOKEN_SECRET?.trim(); + // const secret = + // "487023dd1c1c4d6a07475e96b1cc300fec1e68ac9c2dd7d5ac9b1bf75da1053e"; - // if (secret === undefined || secret === "") { - // return docverError("DOCVER_TOKEN_SECRET ยังไม่ถูกตั้งค่า", 500); - // } + if (secret === undefined || secret === "") { + return docverError("DOCVER_TOKEN_SECRET ยังไม่ถูกตั้งค่า", 500); + } const ttlRaw = Number(process.env.DOCVER_TOKEN_TTL_SECONDS); const ttlSeconds = Number.isFinite(ttlRaw) && ttlRaw > 0 ? Math.floor(ttlRaw) : 3600; diff --git a/docker/web.Dockerfile b/docker/web.Dockerfile index a3d2923..84788ea 100644 --- a/docker/web.Dockerfile +++ b/docker/web.Dockerfile @@ -37,8 +37,6 @@ ENV DOCVER_LINK_TTL_SECONDS=900 RUN npm run build - - # ─── Stage 3: runtime ตัวเบา (แค่ standalone + public/) ─── FROM node:24-alpine AS runner WORKDIR /app diff --git a/lib/docver-token.ts b/lib/docver-token.ts index ce41a3e..92bfc41 100644 --- a/lib/docver-token.ts +++ b/lib/docver-token.ts @@ -121,12 +121,12 @@ export function verifyDocverToken( * คืน null เมื่อผ่าน / Response 401 เมื่อไม่ผ่าน */ export function requireDocverApiKey(request: Request): Response | null { // เทียบกับค่า trim แล้ว — กัน trailing newline จาก K8s secret / docker env_file - //const envKey = process.env.DOCVER_API_KEY?.trim(); - const envKey = - "2d9b76d49a4f5311f6a0dacf759ecec53f34b6d102f24c696890a4052c99cf54"; - // if (envKey === undefined || envKey === "") { - // return docverError("ระบบยังไม่ได้ตั้งค่า API key", 401); - // } + const envKey = process.env.DOCVER_API_KEY?.trim(); + // const envKey = + // "2d9b76d49a4f5311f6a0dacf759ecec53f34b6d102f24c696890a4052c99cf54"; + if (envKey === undefined || envKey === "") { + return docverError("ระบบยังไม่ได้ตั้งค่า API key", 401); + } const provided = request.headers.get("x-api-key"); if (provided === null || provided === "") { return docverError("API key ไม่ถูกต้อง", 401); @@ -150,10 +150,10 @@ export function requireDocverBearer( ): { ok: true; claims: DocverTokenClaims } | { ok: false; response: Response } { const denied = () => ({ ok: false, response: docverError(BEARER_DENIED, 401) }) as const; - //const secret = process.env.DOCVER_TOKEN_SECRET?.trim(); - const secret = - "487023dd1c1c4d6a07475e96b1cc300fec1e68ac9c2dd7d5ac9b1bf75da1053e"; - //if (secret === undefined || secret === "") return denied(); + const secret = process.env.DOCVER_TOKEN_SECRET?.trim(); + // const secret = + // "487023dd1c1c4d6a07475e96b1cc300fec1e68ac9c2dd7d5ac9b1bf75da1053e"; + if (secret === undefined || secret === "") return denied(); const header = request.headers.get("authorization"); if (header === null) return denied(); const match = /^Bearer\s+(\S+)$/i.exec(header);