86 lines
2.3 KiB
TypeScript
86 lines
2.3 KiB
TypeScript
import { createMiddleware } from "hono/factory";
|
|
|
|
import type { CustomJwtPayload } from "../../../types/jwtToken.js";
|
|
import { verify } from "hono/jwt";
|
|
import { db } from "../../../../database/dbclient.js";
|
|
import { modules } from "../../../../database/schema/modules.js";
|
|
import { and, eq } from "drizzle-orm";
|
|
import { userRoles } from "../../../../database/schema/userRoles.js";
|
|
import { tryCatch } from "../../../globalUtils/tryCatch.js";
|
|
|
|
const hasCorrectRole = (requiredRole: string[], module: string) =>
|
|
createMiddleware(async (c, next) => {
|
|
/**
|
|
* We want to check to make sure you have the correct role to be here
|
|
*/
|
|
const authHeader = c.req.header("Authorization");
|
|
|
|
if (!authHeader || !authHeader.startsWith("Bearer ")) {
|
|
return c.json({ error: "Unauthorized" }, 401);
|
|
}
|
|
|
|
const token = authHeader.split(" ")[1];
|
|
|
|
// deal with token data
|
|
const { data: tokenData, error: tokenError } = await tryCatch(
|
|
verify(token, process.env.JWT_SECRET!)
|
|
);
|
|
|
|
if (tokenError) {
|
|
return c.json({ error: "Invalid token" }, 401);
|
|
}
|
|
|
|
const customToken = tokenData as CustomJwtPayload;
|
|
|
|
// Get the module
|
|
const { data: mod, error: modError } = await tryCatch(
|
|
db.select().from(modules).where(eq(modules.name, module))
|
|
);
|
|
if (modError) {
|
|
console.log(modError);
|
|
return;
|
|
}
|
|
|
|
if (mod.length === 0) {
|
|
return c.json({ error: "You have entered an invalid module name" }, 403);
|
|
}
|
|
|
|
// check if the user has the role needed to get into this module
|
|
const { data: userRole, error: userRoleError } = await tryCatch(
|
|
db
|
|
.select()
|
|
.from(userRoles)
|
|
.where(
|
|
and(
|
|
eq(userRoles.module_id, mod[0].module_id),
|
|
eq(userRoles.user_id, customToken.user?.user_id!)
|
|
)
|
|
)
|
|
);
|
|
|
|
if (userRoleError) {
|
|
return;
|
|
}
|
|
|
|
if (!userRole) {
|
|
return c.json(
|
|
{
|
|
error:
|
|
"The module you are trying to access is not active or is invalid.",
|
|
},
|
|
403
|
|
);
|
|
}
|
|
|
|
if (!requiredRole.includes(userRole[0]?.role)) {
|
|
return c.json(
|
|
{ error: "You do not have access to this part of the app." },
|
|
403
|
|
);
|
|
}
|
|
|
|
await next();
|
|
});
|
|
|
|
export default hasCorrectRole;
|