Spaces:
Sleeping
Sleeping
| import { decodeToken } from '../utils/security.js'; | |
| import { User } from '../models/index.js'; | |
| /** Express error helper that mirrors FastAPI's {detail} 4xx body. */ | |
| export function httpError(status, detail) { | |
| const err = new Error(detail); | |
| err.status = status; | |
| err.detail = detail; | |
| return err; | |
| } | |
| function extractToken(req) { | |
| const header = req.headers.authorization || ''; | |
| if (!header.startsWith('Bearer ')) return null; | |
| return header.slice(7).trim(); | |
| } | |
| /** Resolve the current user from a Bearer access token, or throw 401. */ | |
| export async function resolveUser(req) { | |
| const token = extractToken(req); | |
| if (!token) throw httpError(401, 'Not authenticated'); | |
| const payload = decodeToken(token); | |
| if (payload.type !== 'access') throw httpError(401, 'Invalid token type'); | |
| const userId = payload.sub; | |
| if (!userId) throw httpError(401, 'Could not validate credentials'); | |
| const user = await User.findByPk(userId); | |
| if (!user) throw httpError(401, 'User not found'); | |
| return user; | |
| } | |
| /** Middleware: require a valid logged-in user (any role). */ | |
| export function requireUser(req, res, next) { | |
| resolveUser(req) | |
| .then((user) => { | |
| req.user = user; | |
| next(); | |
| }) | |
| .catch(next); | |
| } | |
| /** Middleware: require an admin or superadmin. */ | |
| export function requireAdmin(req, res, next) { | |
| resolveUser(req) | |
| .then((user) => { | |
| if (!['admin', 'superadmin'].includes(user.role)) { | |
| throw httpError(403, 'Not enough permissions'); | |
| } | |
| req.user = user; | |
| next(); | |
| }) | |
| .catch(next); | |
| } | |
| export default { requireUser, requireAdmin, resolveUser, httpError }; | |