31 lines
915 B
TypeScript
31 lines
915 B
TypeScript
import type { PermissionKey } from "@mrp/shared";
|
|
import type { NextFunction, Request, Response } from "express";
|
|
|
|
import { fail } from "./http.js";
|
|
|
|
export function requireAuth(request: Request, response: Response, next: NextFunction) {
|
|
if (!request.authUser) {
|
|
return fail(response, 401, "UNAUTHORIZED", "Authentication is required.");
|
|
}
|
|
|
|
next();
|
|
}
|
|
|
|
export function requirePermissions(requiredPermissions: PermissionKey[]) {
|
|
return (request: Request, response: Response, next: NextFunction) => {
|
|
if (!request.authUser) {
|
|
return fail(response, 401, "UNAUTHORIZED", "Authentication is required.");
|
|
}
|
|
|
|
const available = new Set(request.authUser.permissions);
|
|
const hasAll = requiredPermissions.every((permission) => available.has(permission));
|
|
|
|
if (!hasAll) {
|
|
return fail(response, 403, "FORBIDDEN", "You do not have access to this resource.");
|
|
}
|
|
|
|
next();
|
|
};
|
|
}
|
|
|