34 lines
1.2 KiB
TypeScript
34 lines
1.2 KiB
TypeScript
import type { NitroEvent } from './h3-event';
|
|
import { requireUser, type SessionUser } from './auth';
|
|
import { canDelete, canImport, canWrite, isCrmRole } from '#shared/rbac';
|
|
|
|
const forbidden = () => createError({ statusCode: 403, statusMessage: 'Forbidden' });
|
|
|
|
/** API guard: a signed-in CRM user (admin | editor | viewer). */
|
|
export async function requireStaff(event: NitroEvent): Promise<SessionUser> {
|
|
const user = await requireUser(event);
|
|
if (!isCrmRole(user.role)) throw forbidden();
|
|
return user;
|
|
}
|
|
|
|
/** API guard for mutations a writer/editor may perform. */
|
|
export async function requireWrite(event: NitroEvent): Promise<SessionUser> {
|
|
const user = await requireStaff(event);
|
|
if (!canWrite(user.role)) throw forbidden();
|
|
return user;
|
|
}
|
|
|
|
/** API guard for destructive actions (admin only). */
|
|
export async function requireDelete(event: NitroEvent): Promise<SessionUser> {
|
|
const user = await requireStaff(event);
|
|
if (!canDelete(user.role)) throw forbidden();
|
|
return user;
|
|
}
|
|
|
|
/** API guard for CSV import (admin or editor). */
|
|
export async function requireImport(event: NitroEvent): Promise<SessionUser> {
|
|
const user = await requireStaff(event);
|
|
if (!canImport(user.role)) throw forbidden();
|
|
return user;
|
|
}
|