mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-06-20 13:51:45 +00:00
Julien G.
905c7d460b
* add test suite, mostly covers integration testing, tests are only backend side * workflow runs the correct script * workflow runs the correct script * workflow runs the correct script * unit tests incoming * Fix multer silent rejections and error handler info leak - Revert cb(null, false) to cb(new Error(...)) in auth.ts, collab.ts, and files.ts so invalid uploads return an error instead of silently dropping the file - Error handler in app.ts now always returns 500 / "Internal server error" instead of forwarding err.message to the client * Use statusCode consistently for multer errors and error handler - Error handler in app.ts reads err.statusCode to forward the correct HTTP status while keeping the response body generic
78 lines
2.6 KiB
TypeScript
78 lines
2.6 KiB
TypeScript
import { Request, Response, NextFunction } from 'express';
|
|
import jwt from 'jsonwebtoken';
|
|
import { db } from '../db/database';
|
|
import { JWT_SECRET } from '../config';
|
|
import { AuthRequest, OptionalAuthRequest, User } from '../types';
|
|
|
|
export function extractToken(req: Request): string | null {
|
|
// Prefer httpOnly cookie; fall back to Authorization: Bearer (MCP, API clients)
|
|
const cookieToken = (req as any).cookies?.trek_session;
|
|
if (cookieToken) return cookieToken;
|
|
const authHeader = req.headers['authorization'];
|
|
return (authHeader && authHeader.split(' ')[1]) || null;
|
|
}
|
|
|
|
const authenticate = (req: Request, res: Response, next: NextFunction): void => {
|
|
const token = extractToken(req);
|
|
|
|
if (!token) {
|
|
res.status(401).json({ error: 'Access token required', code: 'AUTH_REQUIRED' });
|
|
return;
|
|
}
|
|
|
|
try {
|
|
const decoded = jwt.verify(token, JWT_SECRET, { algorithms: ['HS256'] }) as { id: number };
|
|
const user = db.prepare(
|
|
'SELECT id, username, email, role FROM users WHERE id = ?'
|
|
).get(decoded.id) as User | undefined;
|
|
if (!user) {
|
|
res.status(401).json({ error: 'User not found', code: 'AUTH_REQUIRED' });
|
|
return;
|
|
}
|
|
(req as AuthRequest).user = user;
|
|
next();
|
|
} catch (err: unknown) {
|
|
res.status(401).json({ error: 'Invalid or expired token', code: 'AUTH_REQUIRED' });
|
|
}
|
|
};
|
|
|
|
const optionalAuth = (req: Request, res: Response, next: NextFunction): void => {
|
|
const token = extractToken(req);
|
|
|
|
if (!token) {
|
|
(req as OptionalAuthRequest).user = null;
|
|
return next();
|
|
}
|
|
|
|
try {
|
|
const decoded = jwt.verify(token, JWT_SECRET, { algorithms: ['HS256'] }) as { id: number };
|
|
const user = db.prepare(
|
|
'SELECT id, username, email, role FROM users WHERE id = ?'
|
|
).get(decoded.id) as User | undefined;
|
|
(req as OptionalAuthRequest).user = user || null;
|
|
} catch (err: unknown) {
|
|
(req as OptionalAuthRequest).user = null;
|
|
}
|
|
next();
|
|
};
|
|
|
|
const adminOnly = (req: Request, res: Response, next: NextFunction): void => {
|
|
const authReq = req as AuthRequest;
|
|
if (!authReq.user || authReq.user.role !== 'admin') {
|
|
res.status(403).json({ error: 'Admin access required' });
|
|
return;
|
|
}
|
|
next();
|
|
};
|
|
|
|
const demoUploadBlock = (req: Request, res: Response, next: NextFunction): void => {
|
|
const authReq = req as AuthRequest;
|
|
if (process.env.DEMO_MODE === 'true' && authReq.user?.email === 'demo@nomad.app') {
|
|
res.status(403).json({ error: 'Uploads are disabled in demo mode. Self-host NOMAD for full functionality.' });
|
|
return;
|
|
}
|
|
next();
|
|
};
|
|
|
|
export { authenticate, optionalAuth, adminOnly, demoUploadBlock };
|