File size: 963 Bytes
4a755c4 5569a86 4a755c4 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 | import type { Request, Response, NextFunction } from 'express';
import { validateSession } from '../services/auth.js';
// Gate the /api/* admin surface behind a dashboard session (#35, item #2).
// The token is the opaque session token issued by /api/auth/login|setup, sent
// as `Authorization: Bearer <token>`. The /v1 proxy is NOT gated by this — it
// keeps its own unified-API-key auth for app clients.
export async function requireAuth(req: Request, res: Response, next: NextFunction): Promise<void> {
try {
const token = req.headers.authorization?.replace(/^Bearer\s+/i, '')
?? (req.headers['x-dashboard-token'] as string | undefined);
const session = await validateSession(token);
if (!session) {
res.status(401).json({ error: { message: 'Authentication required', type: 'authentication_error' } });
return;
}
(req as any).user = session;
next();
} catch (err) {
next(err);
}
}
|