use hashed password for authentication

pages/api/index.ts

@@ -4,6 +4,7 @@ import { posix as pathPosix } from 'path'
 
 import apiConfig from '../../config/api.json'
 import siteConfig from '../../config/site.json'
+import { compareHashedToken } from '../../utils/tools'
 
 const basePath = pathPosix.resolve('/', apiConfig.base)
 const encodePath = (path: string) => {
@@ -75,11 +76,11 @@ export default async function handler(req: NextApiRequest, res: NextApiResponse)
         const odProtectedToken = await axios.get(token.data['@microsoft.graph.downloadUrl'])
         // console.log(req.headers['od-protected-token'], odProtectedToken.data.trim())
 
-        if (req.headers['od-protected-token'] !== odProtectedToken.data.trim()) {
+        if (!compareHashedToken(req.headers['od-protected-token'] as string, odProtectedToken.data)) {
           res.status(401).json({ error: 'Password required for this folder.' })
           return
         }
-      } catch (error) {
+      } catch (error: any) {
         // Password file not found, fallback to 404
         if (error.response.status === 404) {
           res.status(404).json({ error: "You didn't set a password for your protected folder." })