38 lines
1.1 KiB
TypeScript
38 lines
1.1 KiB
TypeScript
import { ADMIN_COOKIE, verifyAdminToken } from '../utils/jwt'
|
|
|
|
/**
|
|
* Protects admin room management endpoints.
|
|
* Public: GET /api/rooms/:roomId (meta), POST /api/rooms/:roomId/access
|
|
*/
|
|
export default defineEventHandler(async (event) => {
|
|
const url = getRequestURL(event)
|
|
const path = url.pathname
|
|
const method = event.method
|
|
|
|
if (!path.startsWith('/api/rooms')) return
|
|
|
|
const isAccess = /\/api\/rooms\/[^/]+\/access$/.test(path) && method === 'POST'
|
|
const isPublicMeta = /\/api\/rooms\/[^/]+$/.test(path) && method === 'GET' && path !== '/api/rooms'
|
|
if (isAccess || isPublicMeta) return
|
|
|
|
const needsAuth =
|
|
path === '/api/rooms' ||
|
|
(/\/api\/rooms\/[^/]+$/.test(path) && (method === 'PATCH' || method === 'DELETE'))
|
|
|
|
if (!needsAuth) return
|
|
|
|
const token =
|
|
getCookie(event, ADMIN_COOKIE) ||
|
|
getHeader(event, 'authorization')?.replace(/^Bearer\s+/i, '')
|
|
|
|
if (!token) {
|
|
throw createError({ statusCode: 401, statusMessage: 'Unauthorized' })
|
|
}
|
|
|
|
try {
|
|
event.context.admin = await verifyAdminToken(token)
|
|
} catch {
|
|
throw createError({ statusCode: 401, statusMessage: 'Unauthorized' })
|
|
}
|
|
})
|