first commit

server/middleware/auth.ts

@@ -0,0 +1,37 @@
+import { ADMIN_COOKIE, verifyAdminToken } from '../utils/jwt'
+
+/**
+ * Protects admin room management endpoints.
+ * Public: GET /api/rooms/:roomId (meta), POST /api/rooms/:roomId/access
+ */
+export default defineEventHandler(async (event) => {
+  const url = getRequestURL(event)
+  const path = url.pathname
+  const method = event.method
+
+  if (!path.startsWith('/api/rooms')) return
+
+  const isAccess = /\/api\/rooms\/[^/]+\/access$/.test(path) && method === 'POST'
+  const isPublicMeta = /\/api\/rooms\/[^/]+$/.test(path) && method === 'GET' && path !== '/api/rooms'
+  if (isAccess || isPublicMeta) return
+
+  const needsAuth =
+    path === '/api/rooms' ||
+    (/\/api\/rooms\/[^/]+$/.test(path) && (method === 'PATCH' || method === 'DELETE'))
+
+  if (!needsAuth) return
+
+  const token =
+    getCookie(event, ADMIN_COOKIE) ||
+    getHeader(event, 'authorization')?.replace(/^Bearer\s+/i, '')
+
+  if (!token) {
+    throw createError({ statusCode: 401, statusMessage: 'Unauthorized' })
+  }
+
+  try {
+    event.context.admin = await verifyAdminToken(token)
+  } catch {
+    throw createError({ statusCode: 401, statusMessage: 'Unauthorized' })
+  }
+})