Optional password protection for the web server

src/web/routes/oauth.js

@@ -37,13 +37,15 @@ as.router.get("/oauth", defineEventHandler(async event => {
 	const session = await auth.useSession(event)
 	let scope = "guilds"
 
-	const parsedFirstQuery = await getValidatedQuery(event, schema.first.safeParse)
-	if (parsedFirstQuery.data?.action === "add") {
-		scope = "bot+guilds"
-		await session.update({selfService: false})
-	} else if (parsedFirstQuery.data?.action === "add-self-service") {
-		scope = "bot+guilds"
-		await session.update({selfService: true})
+	if (!reg.ooye.web_password || reg.ooye.web_password === session.data.password) {
+		const parsedFirstQuery = await getValidatedQuery(event, schema.first.safeParse)
+		if (parsedFirstQuery.data?.action === "add") {
+			scope = "bot+guilds"
+			await session.update({selfService: false})
+		} else if (parsedFirstQuery.data?.action === "add-self-service") {
+			scope = "bot+guilds"
+			await session.update({selfService: true})
+		}
 	}
 
 	async function tryAgain() {

src/web/routes/password.js

@@ -0,0 +1,21 @@
+// @ts-check
+
+const {z} = require("zod")
+const {defineEventHandler, readValidatedBody, sendRedirect} = require("h3")
+const {as, sync} = require("../../passthrough")
+
+/** @type {import("../auth")} */
+const auth = sync.require("../auth")
+
+const schema = {
+	password: z.object({
+		password: z.string()
+	})
+}
+
+as.router.post("/api/password", defineEventHandler(async event => {
+	const {password} = await readValidatedBody(event, schema.password.parse)
+	const session = await auth.useSession(event)
+	await session.update({password})
+	return sendRedirect(event, "../")
+}))