Kenso Grimm
cf4b3ce4d1
Sichert den bisher uncommitteten Produktionsstand des Kundenbereich-Servers, damit kuenftige Deploys (git reset --hard) nichts mehr verwerfen. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
45 lines
1.2 KiB
JavaScript
45 lines
1.2 KiB
JavaScript
import { config } from '../config.js'
|
||
|
||
export async function requireAppwriteStaff(req, res, next) {
|
||
const authHeader = req.get('Authorization') || ''
|
||
const match = authHeader.match(/^Bearer\s+(.+)$/i)
|
||
if (!match) {
|
||
return res.status(401).json({ error: 'Authorization Bearer JWT erforderlich' })
|
||
}
|
||
|
||
const jwt = match[1]
|
||
|
||
try {
|
||
const response = await fetch(`${config.appwrite.endpoint}/account`, {
|
||
headers: {
|
||
'Content-Type': 'application/json',
|
||
'X-Appwrite-Project': config.appwrite.projectId,
|
||
'X-Appwrite-JWT': jwt,
|
||
},
|
||
})
|
||
|
||
const text = await response.text()
|
||
let data = null
|
||
if (text) {
|
||
try {
|
||
data = JSON.parse(text)
|
||
} catch {
|
||
data = { message: text }
|
||
}
|
||
}
|
||
|
||
if (!response.ok) {
|
||
return res.status(401).json({ error: data?.message || 'Ung<6E>ltiges JWT' })
|
||
}
|
||
|
||
if (!Array.isArray(data?.labels) || !data.labels.includes('admin')) {
|
||
return res.status(403).json({ error: 'Admin-Berechtigung erforderlich' })
|
||
}
|
||
|
||
req.appwriteUser = data
|
||
return next()
|
||
} catch (err) {
|
||
return res.status(500).json({ error: err.message || 'JWT-Validierung fehlgeschlagen' })
|
||
}
|
||
}
|